Microsoft Windows EUVD-2026-44304

Exploitation requires local, authenticated access to the target Windows system: the CVSS vector's PR:L means the attacker must already hold at least low/standard-user privileges (not remote or unauthenticated), and AV:L means the trigger occurs on the local machine, not over the network. The vulnerable path is the Cloud Files Mini Filter Driver (cldflt.sys), which is present and loaded by default on supported Windows builds, so no unusual configuration is needed to reach the component - though the specific file/placeholder operations that free-then-reuse the object are the concrete trigger. Limiting factors: an attacker must first obtain code execution as a normal user on the host, and successful privilege escalation typically depends on reliable kernel heap grooming, so a crash/DoS is a more likely outcome than clean SYSTEM code execution absent a refined exploit.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a locally-exploitable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact within an unchanged scope - a classic local elevation-of-privilege profile. No EPSS score, KEV entry, or POC was provided, so exploitation probability signals are absent rather than confirmed low; the analysis relies on the CVSS vector plus Microsoft's reporting. This is a credible priority for patch prioritization because the affected component ships and is active by default across virtually all supported Windows versions and because UAF kernel bugs are historically a productive exploitation class, but there is no evidence of active or public exploitation. Note the vendor tags include 'Denial Of Service' alongside the C:H/I:H/A:H rating - verify with Microsoft's advisory whether reliable code execution or only a crash/DoS is demonstrated, as this materially affects real-world severity.

An attacker who already has a low-privileged foothold on a Windows host - for example a standard domain user, a compromised service account, or code running after a phishing-based initial access - triggers the crafted file operations that drive the Cloud Files mini-filter into using freed kernel memory, grooms the kernel heap to control the reused allocation, and elevates to SYSTEM. No user interaction is required and attack complexity is low, though local access is a prerequisite; no public POC has been identified at time of analysis.