Executive brief
A security vulnerability exists in the Microsoft Windows component responsible for managing cloud-based files. An attacker who already has basic access to a system could exploit this flaw to gain full administrative control. This vulnerability has been observed being used in active attacks, making it a high priority for remediation to prevent unauthorized system takeovers.
Technical details
A use-after-free (UAF) vulnerability (CWE-416) exists in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw is triggered when the driver improperly handles objects in memory, allowing a locally authenticated attacker with low privileges to execute code with elevated system permissions. The attack vector is local, requiring no user interaction. This vulnerability is confirmed to be exploited in the wild and affects multiple versions of Windows 10, 11, and Windows Server. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 25H2
- Microsoft Windows Server 2019, 2022, 23H2, 2025
Timeline
- 2025-12-09: disclosed
- 2025-12-09: advisory
- 2025-12-09: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-12-09: patched