Windows Cloud Files Mini Filter Driver CVE-2026-50374

Physical access to the target machine is the mandatory prerequisite - the CVSS vector AV:P confirms exploitation cannot be performed remotely or over any network channel. The vulnerability resides in the Cloud Files Mini Filter Driver (cldflt.sys), which is active on Windows systems where the Cloud Files API is in use (e.g., OneDrive Files On-Demand enabled); systems where this driver is not loaded may not be exposed to the vulnerable code path, though this has not been independently confirmed as a mitigation by the vendor. The description specifies an 'authorized attacker,' indicating some form of system authorization or account access is implied, though the CVSS PR:N metric suggests no elevated software privileges are required beyond physical access. Exploitation is not automatable per SSVC, meaning scripted or mass remote exploitation is not feasible. Limiting factors include: requirement for physical proximity or device possession, potential need for at least a low-privilege user session to interact with the driver, and the absence of any known public exploit code.

The CVSS 3.1 score of 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact but physically-constrained vulnerability. Physical attack vector (AV:P) sharply limits opportunistic or remote exploitation, which aligns with the EPSS score of 0.30% at the 22nd percentile - statistically near the bottom for active exploitation probability. The SSVC framework corroborates this: Exploitation is currently 'none', it is not automatable (consistent with AV:P), yet Technical Impact is rated 'total', confirming that if physical access is achieved, full compromise is possible. This is not a high-risk CVE for network-perimeter defenders, but it is a meaningful risk in physical-access threat models: kiosk environments, shared workstations, public-access terminals, or scenarios involving insider threat or device theft. The high CIA impact (C:H/I:H/A:H) means that exploitation fully compromises the affected system. There is no conflict between available signals - EPSS, KEV absence, SSVC, and AV:P all consistently point to low real-world exploitation probability at scale.

An attacker with brief, unsupervised physical access to a Windows endpoint - such as a shared kiosk, an unattended corporate laptop, or a device seized during theft - interacts with the Cloud Files Mini Filter Driver to trigger the use-after-free condition in cldflt.sys. By corrupting freed kernel memory at the right moment, the attacker executes arbitrary code in kernel context and elevates from a standard user to SYSTEM privileges. No public proof-of-concept exploit code has been identified at the time of analysis.