EUVD-2026-43951
GHSA-939p-vc2w-r4cq
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:P confirmed by 'physical attack' in description; PR:N as no software credentials required beyond physical presence; full CIA impact from kernel-level privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.
AnalysisAI
Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.
Technical ContextAI
The Windows Cloud Files Mini Filter Driver (cldflt.sys) is a kernel-mode filter driver implementing the Windows Cloud Files API, which supports on-demand file hydration for cloud storage providers such as OneDrive Files On-Demand. Operating in kernel space under the Windows Filter Manager (fltmgr.sys) framework, the driver processes I/O requests for placeholder files. CWE-416 (Use After Free) in this context means that a kernel object is accessed after its memory has been freed and potentially reallocated, enabling memory corruption at the kernel level. CPE data confirms all affected components are Microsoft Windows products spanning cpe:2.3:a:microsoft:windows_10_version_1809 through cpe:2.3:a:microsoft:windows_server_2025, indicating the vulnerable code path is present across a decade-long Windows release span. The CVSS vector AV:P reflects that exploitation requires physical interaction with the target hardware.
RemediationAI
Apply the vendor-released cumulative update that brings affected builds to the patched versions listed above - specifically targeting the build thresholds provided by EUVD data (e.g., Windows 10 22H2 to 10.0.19045.7548 or later, Windows Server 2025 to 10.0.26100.33158 or later). Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50374 for the exact KB article and deployment guidance per version. Where patching is not immediately possible, the most effective compensating control given the physical attack vector is physical security hardening: enforce full-disk encryption (BitLocker) so that physical access does not automatically yield exploitable OS access, restrict physical access to sensitive machines, enable UEFI Secure Boot and disable boot-from-external-media to prevent attacker-controlled boot environments, and ensure device-lock and session-timeout policies are enforced. Disabling the Cloud Files Mini Filter Driver outright would break OneDrive Files On-Demand and other cloud provider integrations and is not recommended except on systems that do not use those features.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today