Windows Cloud Files EUVD-2026-29625

Exploitation requires local access to an affected Windows system with an existing low-privileged authenticated account or code-execution foothold (CVSS PR:L, AV:L), no user interaction (UI:N), and interaction with the Cloud Files Mini Filter Driver (cldflt.sys) code path, which is present by default on supported Windows 10/11 and Server 2019-2025 builds. Limiting factors: it is NOT remotely exploitable and cannot be reached over the network, the attacker must already be able to run code locally, and hosts patched to the fixed build numbers or with the Cloud Files sync engine disabled are not exploitable via this path.

Signals are internally consistent and point to a genuine but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) indicates a local, low-complexity attack requiring only low privileges and no user interaction, with total technical impact - matching the SSVC 'Technical Impact: total' rating. However SSVC also reports Exploitation: none and Automatable: no, EPSS is 0.04% (12th percentile), it is absent from CISA KEV, and no POC is known, so widespread or automated exploitation is unlikely in the near term. This is a classic post-compromise local EoP: valuable to an attacker who already has a foothold (malware, phishing, or a low-priv account) as a second-stage SYSTEM escalation, but it is not remotely reachable and not an internet-facing emergency. Note the minor tension between the 'Denial Of Service' tag and the C:H/I:H/A:H vector - the vector and 'total' technical impact indicate this is fundamentally a privilege-escalation/memory-corruption issue rather than merely DoS.

An attacker who has already obtained a standard (non-admin) account or code execution on a Windows host - for instance through phishing or a compromised low-privilege service - invokes the Cloud Files Mini Filter Driver in a way that triggers the use-after-free, grooms the freed kernel object, and reuses the dangling reference to execute code in kernel context, elevating to SYSTEM. No user interaction and no remote access are required, and the low attack complexity makes reliable exploitation plausible, but as of analysis no public POC or in-the-wild exploitation is known.