PT-2026-40220 · Microsoft · Common Log File System Driver+1

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-40407

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver (affected versions not specified)

Description A heap-based buffer overflow in the Windows Common Log File System Driver allows an authorized attacker to perform local privilege escalation. This issue enables users with low privileges to gain elevated permissions on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2026-06616

CVE-2026-40407

Affected Products

Common Log File System Driver

Windows

References · 6

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40407 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06616 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40407 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-40407 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40407 · Security Note
• https://twitter.com/windowsforum/status/2054287677344670138 · Twitter Post