Windows Cloud Files CVE-2026-88106

Requires pre-existing local authenticated access (PR:L) to the target Windows host - this is a privilege-escalation primitive, not a remote entry point. Exploitation specifically targets the Windows Cloud Files Mini Filter Driver (cldflt.sys), the component underpinning cloud-sync placeholder files (OneDrive Files On-Demand and similar providers). The AC:H metric indicates a race condition or narrow timing/memory-state window must be won to reclaim the freed object, which limits reliability and blocks fully deterministic exploitation. No user interaction is required (UI:N), and scope is unchanged (S:U), meaning impact stays within the local system's security authority. Limiting factors for defenders: an attacker must already be on the box with at least low privileges, and the high complexity reduces single-shot success.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated access with low privileges and must win a race condition or meet a specific timing/state condition (AC:H), which materially raises the bar versus a trivially exploitable flaw. The 7.0 base score is driven by full C:H/I:H/A:H impact (kernel-mode code execution via the Cloud Files mini-filter driver), consistent with CWE-416 use-after-free in a kernel driver. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent widespread exploitation; this reads as a high-impact-but-constrained issue rather than an urgent fire. Note a signal tension: it was reported internally by Microsoft (secure@microsoft.com) with a patch already available, which typically indicates coordinated disclosure rather than observed in-the-wild abuse. Overall priority: patch in normal cadence, prioritized on multi-user or shared Windows hosts where untrusted local users exist.

An attacker who has already gained low-privilege code execution on a Windows host (e.g., a standard user account or a compromised low-integrity process) interacts with the Cloud Files Mini Filter Driver (cldflt.sys) to trigger a use-after-free, winning a timing/race window to reclaim the freed kernel object. Successful exploitation yields SYSTEM-level privileges, enabling full compromise of the machine. No public exploit code has been identified at time of analysis, and the high attack complexity means reliable exploitation requires precise control over the race condition.