Windows Cloud Files CVE-2025-62457

Requires pre-existing local access with at least low-privileged code execution on an affected Windows system (AV:L, PR:L); there is no remote or unauthenticated path and no user interaction is needed. The vulnerable component is the Cloud Files Mini Filter Driver (cldflt.sys), which underpins Windows Cloud Files / OneDrive Files On-Demand and is present by default across supported Windows client and server builds, so no non-default configuration is required to reach the driver. The practical limiting factor is the need for an initial foothold - this is a second-stage escalation primitive, not an initial-access vulnerability.

All available signals point to a genuine but not emergency-grade local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local attack vector requiring low privileges and no user interaction, yielding full CIA impact within the same security scope - the classic profile of a kernel-driver EoP used as a post-compromise step. EPSS is low at 0.40% (32nd percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The 7.8 score reflects impact if exploited, not likelihood; there is no conflict between the signals - low EPSS plus no KEV plus local-only vector consistently indicate this is a solid patch-in-cycle item rather than a drop-everything priority. The one nuance worth verifying: the CWE-125 (out-of-bounds read) and the 'Information Disclosure' tag describe a read primitive, yet the vendor rates C:H/I:H/A:H and classifies this as privilege elevation, implying the OOB read is leveraged (e.g., to defeat KASLR or corrupt adjacent state) rather than being a pure info-leak - treat the full-impact rating as vendor-asserted.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity service) runs a crafted program that issues malformed I/O to the Cloud Files Mini Filter Driver (cldflt.sys), triggering the out-of-bounds read to leak kernel memory or corrupt kernel state and escalate to SYSTEM. Because AV:L and PR:L, no network access or user interaction is needed, but the attacker must first obtain local code execution. No public proof-of-concept is referenced at time of analysis.