Executive brief
A security vulnerability exists in the Windows Cloud Files Mini Filter Driver, which manages how the operating system interacts with cloud-stored files. An authorized user on the system could exploit this flaw to view sensitive information that should normally be restricted. While this does not allow for remote control of the computer, it could lead to the exposure of confidential data or system memory contents.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw is triggered when the driver fails to properly validate the length of a buffer before performing a read operation. An attacker with local access and low privileges can exploit this to read data from beyond the intended buffer, potentially disclosing sensitive kernel memory information. The attack requires local authentication but no user interaction. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server versions.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory