CVE-2023-28252

ENISA EUVD: EUVD-2023-31960 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 12 articles Published: 2023-04-11

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

62.21%

probability

This CVE has a 62.21% probability of being exploited in the next 30 days.

0% Top 98.4th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

NVD

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected Products

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 1809

10.0.0

Microsoft

Windows Server 2019

10.0.17763.0

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0

Microsoft

Windows Server 2022

10.0.20348.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 20h2

microsoft

windows 10 21h2

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.4252

Microsoft

Windows 11 version 21H2

10.0.0 <10.0.22000.1817

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.24216

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.2846

Microsoft

Windows 10 Version 21H2

10.0.19043.0 <10.0.19044.2846

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.1555

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.19869

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.5850

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.20919

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.22015

Microsoft

Windows 10 Version 20H2

10.0.0 <10.0.19042.2846

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.6003.0 <6.0.6003.22015

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.7601.0 <6.1.7601.26466

Microsoft

Windows 10 Version 1809

10.0.0 <10.0.17763.4252

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.5850

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.24216

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.1.7601.0 <6.1.7601.26466

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.1668

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.4252

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.5850

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.20919

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.22015

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.4252

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-122 · Heap-based Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write CWE-788 · Access of Memory Past End of Buffer

Google Project Zero

Patched

April 11, 2023

Reported by

Boris Larin (oct0xor), Genwei Jiang with Mandiant, Quan Jin with DBApp Security WeBin Lab

Root Cause Analysis

https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-28252.html

Exploits & PoC

fortra/CVE-2023-28252

181 2023-07-10

duck-sec/CVE-2023-28252-Compiled-exe

A modification to fortra's CVE-2023-28252 exploit, compiled to exe

55 2024-01-24

byt3n33dl3/CLFS

it's a CVE-2023-28252 (Patched), but feel free to use it for check any outdated software or reseach

6 2024-07-09

726232111/CVE-2023-28252

0 2023-08-02

Danasuley/CVE-2023-28252-

Обнаружение эксплойта CVE-2023-28252

0 2023-11-13

Vulmatch/CVE-2023-28252

The TL;DR for the learnings of Windows Vulnerability CVE-2023-28252

0 2024-06-16

6 repos — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252

vendor-advisory

Signal Intelligence

Confidenceⓘ

92%

EPSS 62.21%

CVSS v3.1 7.8

Mentions 12

Last Seen Apr 08, 2025

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Analyst Note

This CVE meets confirmed status criteria with strong evidence of real-world exploitation by ransomware gangs, high CVSS score (7.8), and verification from reputable security sources including Google Project Zero. The vulnerability in the Windows Common Log File System Driver represents a critical elevation of privilege vector that has been actively exploited in the wild since 2023.