Executive brief
A security vulnerability exists in the Windows component responsible for managing cloud-based files, such as those used by OneDrive. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.
Technical details
This vulnerability is a use-after-free (UAF) and Time-of-check Time-of-use (TOCTOU) race condition within the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw occurs when the driver incorrectly manages memory objects during file operations, allowing an attacker to manipulate memory after it has been freed. To exploit this, an attacker must have local access and the ability to execute code with low privileges. Successful exploitation allows the attacker to gain SYSTEM-level privileges. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory