CVE-2026-2636

{"id": "CVE-2026-2636", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2026-02-25T20:23:48.910", "references": [{"url": "https://www.fortra.com/security/advisories/research/fr-2026-001", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "description": [{"lang": "en", "value": "CWE-159"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable."}, {"lang": "es", "value": "Esta vulnerabilidad se produce por un fallo CWE?159: 'Manejo Inadecuado del Uso Inv\u00e1lido de Elementos Especiales', lo que lleva a una inconsistencia irrecuperable en el controlador CLFS.sys. Esta condici\u00f3n fuerza una llamada a la funci\u00f3n KeBugCheckEx, permitiendo a un usuario sin privilegios provocar un fallo del sistema. Microsoft corrigi\u00f3 silenciosamente esta vulnerabilidad en la actualizaci\u00f3n acumulativa de septiembre de 2025 para Windows 11 2024 LTSC y Windows Server 2025. Windows 25H2 (lanzado en septiembre) fue lanzado con el parche. Windows 1123h2 y versiones anteriores siguen siendo vulnerables."}], "lastModified": "2026-02-27T14:06:59.787", "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}