Windows Cloud Files Mini Filter Driver CVE-2026-80093

The attacker must have a valid low-privilege local or RDP session on the target Windows machine (PR:L). The Windows Cloud Files Mini Filter Driver (cldflt.sys) must be loaded, which is the default state on Windows 10/11 and Windows Server systems that have cloud file sync capabilities enabled. High attack complexity (AC:H) implies a non-trivial exploit requiring careful heap manipulation or precise race condition timing - automated, reliable exploitation is not straightforward. No user interaction is required beyond the attacker's own session activity. Exploitation is bounded to the local system scope (S:U); network-remote exploitation without an existing local session is not possible with this vector alone.

The provided CVSS base score of 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local privilege escalation with meaningful complexity. The AC:H is the primary risk governor - kernel UAF exploitation typically requires heap feng shui or a race window, raising the bar for reliable exploitation. No CISA KEV listing and no public exploit code are reported, reducing near-term opportunistic risk. EPSS data was not supplied. Real-world risk is elevated for environments where untrusted local users or sandboxed code execution exist (e.g., shared Windows terminals, RDP environments, browser sandbox escapes chaining to LPE). For typical enterprise desktops with endpoint detection, the AC:H combined with absence of public exploit makes this a patch-cycle priority rather than an emergency response.

An attacker who already has a standard (low-privilege) user account on a Windows system - via phishing, compromised credential, or escape from a sandboxed context - crafts a sequence of file operations against the cloud file mini-filter driver, triggering a race condition that causes the driver to reference freed kernel memory. By controlling the freed allocation's content, the attacker overwrites a kernel structure to redirect execution to shellcode running at SYSTEM privilege. No public exploit code has been identified at time of analysis.