What’s Vulnerable › Vulnerabilities
CVE-2026-2636: Denial of Service in Microsoft OS
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-25 · updated 2026-06-17
- Weakness: CWE-159
Description
This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.
Affected products
- Microsoft Windows OS: before 25H2; through 1123h2 — fixed in 25H2
How to fix
Upgrade to a fixed version: Microsoft Windows OS 25H2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-2636 or the next vulnerability affects your stack