EUVD-2026-43926
GHSA-2x45-9px6-2r4c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with low privileges required; OOB read yields high confidentiality impact with no integrity or availability effect and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in the Windows Cloud Files Mini Filter Driver (cldflt.sys) exposes kernel memory contents to local attackers with standard user privileges. Affected across Windows 10 (1809 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server 2019 through 2025, the vulnerability allows an authorized local account to read beyond allocated buffer boundaries in the driver that underpins cloud sync features such as OneDrive Files On-Demand. No public exploit identified at time of analysis; EPSS is 0.31% (22nd percentile) and SSVC rates exploitation as none, making this a moderate patch priority rather than an emergency response.
Technical ContextAI
The Windows Cloud Files Mini Filter Driver (cldflt.sys) is a kernel-mode driver implementing the Cloud Files API, which powers placeholder file synchronization features including OneDrive Files On-Demand. CWE-125 (Out-of-Bounds Read) indicates the driver performs a memory read operation without adequately validating that the target address or length stays within the bounds of an allocated buffer. This class of defect in kernel-mode drivers commonly arises when user-supplied I/O control codes (IOCTLs) or file metadata structures are consumed without strict size checks. Reading beyond the buffer boundary in kernel space can leak adjacent memory contents - potentially including addresses (undermining ASLR), credentials cached in memory, or other sensitive kernel data. Affected CPEs span the application-layer packaging of the feature across Windows 10 version 1809, 21H2, 22H2, Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2019, 2022, and 2025 in both full and Server Core installations.
RemediationAI
Apply the Microsoft-released patch addressing CVE-2026-50401, distributed through Windows Update and available via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50401. Target builds are: Windows 10 1809 to 10.0.17763.9020 or later, Windows 10 21H2 to 10.0.19044.7548 or later, Windows 10 22H2 to 10.0.19045.7548 or later, Windows 11 24H2 to 10.0.26100.8875 or later, Windows 11 25H2 to 10.0.26200.8875 or later, Windows 11 26H1 to 10.0.28000.2269 or later, Windows Server 2019 to 10.0.17763.9020 or later, Windows Server 2022 to 10.0.20348.5386 or later, and Windows Server 2025 to 10.0.26100.33158 or later. No specific workaround is documented by Microsoft; however, organizations that have disabled OneDrive Files On-Demand and cloud sync functionality via Group Policy (disabling the Cloud Files feature) would reduce exposure to this driver code path, though this trade-off eliminates cloud sync functionality entirely. Prioritize patching on systems where insider threat actors or post-compromise lateral movement scenarios are assessed as realistic.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today