Microsoft disclosed CVE-2026-40407 on May 12, 2026 as an Important Windows Common Log File System Driver elevation-of-privilege vulnerability, caused by a heap-based buffer overflow and affecting supported Windows client and server releases with updates available through the May Patch Tuesday...