CVE-2022-24521

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 7 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

7.63%

probability

This CVE has a 7.63% probability of being exploited in the next 30 days.

0% Top 92.0th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Windows Common Log File System Driver Elevation of Privilege

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write

Google Project Zero

Patched

April 12, 2022

Reported by

National Security Agency, Adam Podlosky and Amir Bazine of Crowdstrike

Root Cause Analysis

https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-24521.html

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability

TheHackerNews

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

TheHackerNews

Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability

TheHackerNews

Windows zero-day vulnerability exploited in ransomware attacks

BleepingComputer Apr 11, 2023

April 2022 Patch Tuesday: Microsoft Releases 145 Vulnerabilities With 10 Critical; Adobe Releases 4 Advisories, 78 Vulnerabilities With 51 Critical.

Qualys Apr 12, 2022

Security Advisory 2022-026

CERT-EU Apr 13, 2022

Microsoft April 2022 Patch Tuesday fixes 119 flaws, 2 zero-days

BleepingComputer Apr 12, 2022

Signal Intelligence

Confidenceⓘ

82%

EPSS 7.63%

Mentions 7

Last Seen Apr 11, 2023

CNA Information

Analyst Note

CVE-2022-24521 is confirmed as a legitimate elevation of privilege vulnerability in Windows 10 with a HIGH CVSS score (7.8) and validation from reputable sources including Google Project Zero and CERT-EU security advisory. The vulnerability affects the Common Log File System Driver, a critical component, supporting the confirmed status despite limited public article coverage.