cve-2026-40407

CVE-2026-40407 is a Windows Common Log File System (CLFS) driver elevation-of-privilege vulnerability disclosed by Microsoft on May 12, 2026 as part of the May Patch Tuesday release. Rated Important, this heap-based buffer overflow flaw allows a local attacker who already has limited access to gain SYSTEM privileges. It affects supported Windows client and server versions. While not remotely exploitable, the vulnerability is considered significant because it targets a kernel-adjacent component historically associated with privilege escalation attacks. Administrators are advised to apply the available security updates promptly to mitigate the risk of local privilege escalation.