Executive brief
The Windows Cloud Files Mini Filter Driver is a system component that manages file synchronization in Windows. A use-after-free vulnerability allows an authorized local user to execute arbitrary code with elevated privileges, potentially compromising system security and enabling full system takeover.
Technical details
A use-after-free vulnerability exists in the Windows Cloud Files Mini Filter Driver, a kernel-mode driver responsible for cloud file synchronization. The vulnerability allows an authorized local attacker to trigger memory access after the memory has been freed, leading to code execution at the kernel level. This requires local code execution capability but does not require administrative privileges. An attacker with valid user credentials can exploit this flaw to escalate to SYSTEM privileges, potentially compromising the entire operating system.
Affected products
- Microsoft Windows Cloud Files Mini Filter Driver <UNKNOWN>
Timeline
- 2026-09-08: disclosed
- 2026-09-08: advisory