TI-2026-02251 Aliases CVE-2026-2636 GHSA-fww6-3c6x-rf7p

Denial of Service in Microsoft OS

LOW 25CWE-159Published 2026-02-25 · Updated 2026-02-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00467 40th percentileScored 2026-11-08

Fix Fixed Windows OS (Microsoft): 25H2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Windows OS	before 25H2; up to 1123h2	25H2	Patch available	CNA

Windows OS VendorMicrosoft Affected before 25H2; up to 1123h2 Fixed in 25H2 Patch available CNA

Remediation

Fix · CNA Windows OS (Microsoft) Fixed in 25H2

Timeline

2026-10-02 Threatist record created from CVE-2026-2636
2026-10-03 Alias added: GHSA-fww6-3c6x-rf7p

References

Other 1

https://www.fortra.com/security/advisories/research/fr-2026-001

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences