Windows Cloud Files CVE-2025-62221

Exploitation requires the attacker to already have local, authenticated, low-privileged execution on the target Windows system (PR:L, AV:L) - this is a post-access privilege-escalation bug, not a remote entry point. The vulnerable component is the Cloud Files Mini Filter Driver (cldflt.sys), which underpins OneDrive/Cloud Files placeholder and sync-on-demand functionality and is present by default across supported Windows 10, Windows 11, and Windows Server builds. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is that the attacker must first gain a local foothold; there is no network-reachable attack surface, which bounds real-world risk to already-compromised or multi-user hosts.

This is a genuine patch-priority local privilege escalation, not an inflated high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a use-after-free (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys, a kernel-mode component) reachable by any authenticated local user with low privileges, no user interaction, and low attack complexity, yielding full high confidentiality/integrity/availability impact - i.e. a jump to SYSTEM. Kernel driver UAF bugs are historically a favored, reliable EoP primitive. However, key exploitation signals are ABSENT from the provided data: no EPSS score, no SSVC decision, and no explicit KEV or POC flag were supplied. One reference is a CISA KEV catalog QUERY URL for this CVE, but a query link is NOT confirmation of KEV listing - it must be independently verified before treating this as actively exploited. Under the precision rules, with no explicit KEV=YES or POC=YES, this is classed as no public exploit identified at time of analysis. Bottom line: because it is a local-kernel EoP in a component shipped on virtually every modern Windows build, it is a real prioritization target as a post-compromise privilege-escalation step, even though widespread automated remote exploitation does not apply (AV:L).

An attacker who already has low-privileged code execution on a Windows host (e.g. via phishing, a malicious app, or a foothold from another bug) runs a crafted program that manipulates Cloud Files (OneDrive placeholder/sync) operations to trigger the use-after-free in cldflt.sys, corrupting kernel memory to gain SYSTEM. No user interaction is required and attack complexity is low. No public exploit or active-exploitation status is confirmed in the provided data.