EUVD-2026-43951
GHSA-939p-vc2w-r4cq
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:P confirmed by 'physical attack' in description; PR:N as no software credentials required beyond physical presence; full CIA impact from kernel-level privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.
AnalysisAI
Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.
Technical ContextAI
The Windows Cloud Files Mini Filter Driver (cldflt.sys) is a kernel-mode filter driver implementing the Windows Cloud Files API, which supports on-demand file hydration for cloud storage providers such as OneDrive Files On-Demand. Operating in kernel space under the Windows Filter Manager (fltmgr.sys) framework, the driver processes I/O requests for placeholder files. CWE-416 (Use After Free) in this context means that a kernel object is accessed after its memory has been freed and potentially reallocated, enabling memory corruption at the kernel level. CPE data confirms all affected components are Microsoft Windows products spanning cpe:2.3:a:microsoft:windows_10_version_1809 through cpe:2.3:a:microsoft:windows_server_2025, indicating the vulnerable code path is present across a decade-long Windows release span. The CVSS vector AV:P reflects that exploitation requires physical interaction with the target hardware.
RemediationAI
Apply the vendor-released cumulative update that brings affected builds to the patched versions listed above - specifically targeting the build thresholds provided by EUVD data (e.g., Windows 10 22H2 to 10.0.19045.7548 or later, Windows Server 2025 to 10.0.26100.33158 or later). Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50374 for the exact KB article and deployment guidance per version. Where patching is not immediately possible, the most effective compensating control given the physical attack vector is physical security hardening: enforce full-disk encryption (BitLocker) so that physical access does not automatically yield exploitable OS access, restrict physical access to sensitive machines, enable UEFI Secure Boot and disable boot-from-external-media to prevent attacker-controlled boot environments, and ensure device-lock and session-timeout policies are enforced. Disabling the Cloud Files Mini Filter Driver outright would break OneDrive Files On-Demand and other cloud provider integrations and is not recommended except on systems that do not use those features.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today