Windows Cloud Files EUVD-2026-29596

The attacker must already have a local, authenticated low-privileged foothold on the target Windows host (CVSS AV:L, PR:L, UI:N) and be able to invoke Cloud Filter/placeholder operations that drive the vulnerable code path in cldflt.sys. What limits exploitation: no remote or unauthenticated vector (local access is mandatory), SSVC marks it not automatable (requires prior access and likely a UAF race/reallocation primitive), and only unpatched builds below the fixed revisions are vulnerable. No special non-default feature toggle is documented as required - the Cloud Files minifilter is present by default - but the host must be on an affected version to be exploitable.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8 High) describes a locally exploitable, low-complexity flaw requiring only existing low privileges and no user interaction, with total impact to confidentiality, integrity, and availability - consistent with SSVC 'Technical Impact: total.' However, the exploitation signals point away from urgency: SSVC Exploitation is 'none', SSVC Automatable is 'no' (an attacker must already have a local foothold), EPSS is 0.04% (12th percentile), and there is no KEV listing or evidence of a public POC. The tags include 'Denial Of Service' alongside 'Use After Free/Memory Corruption', which is slightly narrower than the CVSS I:H/C:H, but for a kernel UAF full memory-corruption-to-EoP is the credible worst case. Net: a genuine kernel elevation-of-privilege that matters as a post-compromise step (e.g., malware or a foothold escalating to SYSTEM), but not a mass-exploitation or wormable threat - prioritize in normal Patch Tuesday cadence, higher on multi-user or high-value hosts.

An attacker who already has a standard (low-privileged) local account or code execution on the host - for example, via phishing, a compromised service, or an unprivileged malware payload - triggers the use-after-free in the Cloud Files minifilter by manipulating cloud placeholder operations to reallocate freed kernel memory with controlled data. Successful exploitation yields SYSTEM privileges, enabling persistence, credential theft, or tampering. No public exploit is identified at time of analysis, and CVSS AC:L suggests the race/UAF is not high-complexity to trigger once a working technique exists.