Microsoft Windows 11/Server 2025 Driver CLFS.sys KeBugCheckEx invalid special elements

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Microsoft Windows 11/Server 2025. Affected by this vulnerability is the function KeBugCheckEx in the library CLFS.sys of the component Driver. The manipulation leads to improper handling of invalid use of special elements. This vulnerability is documented as CVE-2026-2636. The attack needs to be performed locally. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows 11/Server 2025. It has been rated as problematic. This issue affects the function KeBugCheckEx in the library CLFS.sys of the component Driver. The manipulation with an unknown input leads to a improper handling of invalid use of special elements vulnerability. Using CWE to declare the problem leads to CWE-159. The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity. Impacted is availability. The summary by CVE is:

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.

It is possible to read the advisory at fortra.com. The identification of this vulnerability is CVE-2026-2636 since 02/17/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/26/2026).

Applying a patch is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 11
• Server 2025

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion