Windows Cloud Files Mini Filter Driver CVE-2026-83991

Exploitation requires an existing local low-privilege user account on the target Windows system - no remote access vector exists. The Windows Cloud Files Mini Filter Driver (CldFlt) must be loaded, which occurs by default on systems with OneDrive integration or any application using the Windows Cloud Files API. No additional non-default configuration is required beyond having the driver present in the I/O stack. Limiting factors include: the attacker must already have local code execution as any authenticated user; no network-based exploitation path exists; impact is limited to integrity (tampering) with no confidentiality breach or denial of service.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, score 5.5) accurately characterizes the threat surface: exploitation requires local code execution as any low-privilege Windows user, and the scope is contained to the local system with no confidentiality or availability impact. EPSS data was not supplied, so exploitation probability cannot be quantified from that signal; however, the absence of a KEV listing and absence of public exploit code suggest this is not actively weaponized. The medium CVSS score reflects a realistic risk profile: this is meaningful on multi-user systems or enterprise environments where users should not be able to tamper with cloud-file driver state, but it is not exploitable remotely and requires a foothold. Organizations using OneDrive or other Windows Cloud Files API consumers in regulated or sensitive environments should treat this as a routine patch-cycle priority rather than an emergency.

A standard local user account on a multi-user Windows workstation or Remote Desktop server identifies the Cloud Files Mini Filter Driver's unauthenticated IOCTL entry point through driver interface enumeration. The attacker constructs a crafted DeviceIoControl call targeting the critical function that bypasses the expected authentication check, causing the driver to tamper with cloud file metadata or filter driver state without requiring administrative rights. No public exploit code was identified at time of analysis, so exploitation currently requires manual research into the driver interface.