CVE-2023-28252

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 13 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

62.21%

probability

This CVE has a 62.21% probability of being exploited in the next 30 days.

0% Top 98.4th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Common Log File System Driver Elevation of Privilege

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-122 · Heap-based Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write CWE-788 · Access of Memory Past End of Buffer

Google Project Zero

Patched

April 11, 2023

Reported by

Boris Larin (oct0xor), Genwei Jiang with Mandiant, Quan Jin with DBApp Security WeBin Lab

Root Cause Analysis

https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-28252.html

2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is

Qualys Dec 19, 2023

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability

TheHackerNews

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

TheHackerNews

Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability

TheHackerNews

Windows zero-day vulnerability exploited in ransomware attacks

BleepingComputer Apr 11, 2023

Defense Lessons From the Black Basta Ransomware Playbook

Qualys Feb 25, 2025

Microsoft and Adobe Patch Tuesday April 2023 Security Update Review

Qualys Apr 12, 2023

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Microsoft: Windows CLFS zero-day exploited by ransomware gang

BleepingComputer Apr 08, 2025

Microsoft patches Windows Kernel zero-day exploited since 2023

BleepingComputer Mar 12, 2025

Microsoft April 2023 Patch Tuesday fixes 1 zero-day, 97 flaws

BleepingComputer Apr 11, 2023

VMware ESXi Flaw Exploited by Ransomware Groups for Admin Access

TheHackerNews

PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware

TheHackerNews

Signal Intelligence

Confidenceⓘ

92%

EPSS 62.21%

Mentions 13

Last Seen May 27, 2026

CNA Information

Analyst Note

This CVE meets confirmed status criteria with strong evidence of real-world exploitation by ransomware gangs, high CVSS score (7.8), and verification from reputable security sources including Google Project Zero. The vulnerability in the Windows Common Log File System Driver represents a critical elevation of privilege vector that has been actively exploited in the wild since 2023.