Windows Cloud Files Mini Filter EUVD-2026-43926

Exploitation requires a local, authenticated session on the target Windows system with at least standard user (non-administrator) privileges, consistent with CVSS PR:L. The Cloud Files Mini Filter Driver must be active - this driver is enabled by default on Windows 10/11 and Server editions that support cloud sync features such as OneDrive Files On-Demand; environments where this feature has been explicitly disabled via Group Policy are not exposed to the vulnerable code path. Remote unauthenticated exploitation is not possible. Exploitation is not automatable per SSVC. Limiting factors include the requirement for local code execution or an interactive/remote desktop session, making this unsuitable for initial access but useful as a secondary step in a chained attack.

The CVSS 3.1 score of 5.5 (Medium) is consistent with the threat model: local access (AV:L), low complexity (AC:L), and standard user privileges (PR:L) are required, scope is unchanged (S:U), and impact is confined to high confidentiality with no integrity or availability effect. These metrics align well with an information-disclosure-only kernel driver flaw. EPSS at 0.31% (22nd percentile) confirms very low exploitation activity in the wild, and SSVC independently rates exploitation as none with technical impact as partial. No CISA KEV listing exists. The convergence of low EPSS, SSVC exploitation:none, and local-only attack vector means this is not an emergency priority in most environments. However, the high confidentiality impact (C:H) is noteworthy: kernel memory disclosure can serve as a stepping stone in a multi-stage privilege escalation chain, particularly for ASLR bypass. Organizations running sensitive Windows workloads where insider threat or post-initial-access lateral movement are concerns should treat this with higher urgency than the base score alone implies. No data conflicts exist in the available signals.

A local attacker with a standard Windows user account submits a crafted IOCTL or manipulated file metadata structure to the Cloud Files Mini Filter Driver, triggering the out-of-bounds read in cldflt.sys. The resulting memory disclosure leaks adjacent kernel memory, which could expose ASLR layout information or cached sensitive data useful for constructing a subsequent privilege escalation exploit. No public proof-of-concept exists at time of analysis, and the attack requires local authenticated access.