Windows Cloud Files Driver EUVD-2026-73216

Exploitation requires a valid, low-privileged user account on the target Windows system (PR:L per CVSS vector) - the Microsoft advisory explicitly describes an 'authorized attacker,' meaning anonymous or unauthenticated remote exploitation is not possible. The Cloud Files Mini Filter Driver (cldflt.sys) must be loaded and active, which is the default on any system where cloud storage integration is enabled (OneDrive sync is enabled by default on consumer and many enterprise Windows installations). Attack complexity is rated High (AC:H), indicating a race condition or precise heap-grooming requirement that limits reliable, weaponizable exploitation. No user interaction is required once the attacker has local execution. Exploitation is constrained to local vectors - remote-only access (SSH, RDP without shell) is insufficient without the ability to run arbitrary code locally. Systems with Windows Defender Credential Guard or Virtualization-Based Security (VBS) in full enforcement may raise the bar for kernel object manipulation, though this is not confirmed as a full mitigation.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation that requires existing user access and high exploitation complexity, most likely due to a race condition inherent to UAF exploitation in the kernel I/O path. While the full C:H/I:H/A:H triad signals full OS compromise upon successful exploitation, AC:H is a meaningful barrier - reliable UAF exploitation in kernel space typically demands precise memory grooming or timing, limiting opportunistic use. No EPSS data was provided; the absence of KEV listing and public PoC suggests this is not yet under active exploitation. However, local privilege escalation vulnerabilities in Windows kernel drivers are a perennial target for post-exploitation tooling and ransomware operators who already have a foothold. The breadth of affected versions (Windows 10 1809 through Windows 11 26H1, and multiple Windows Server releases) significantly increases enterprise exposure. The 'Denial Of Service' tag in the input metadata reflects that a failed UAF exploit can trigger a kernel panic (BSoD), but the primary security impact is privilege escalation rather than DoS - this should be weighted accordingly when triaging. No conflicting signals between the CVSS vector and the description were identified.

An attacker who has obtained a low-privileged Windows user account (via phishing, credential stuffing, or an initial foothold) triggers a race condition in the Cloud Files Mini Filter Driver by issuing concurrent file system operations against a cloud-backed placeholder file, causing a kernel object to be freed while a second thread still holds a reference to it. By carefully timing the operations and grooming the kernel heap to reclaim the freed region with attacker-controlled data, the attacker overwrites a security token pointer or function dispatch table entry, ultimately executing code in kernel context and elevating to NT AUTHORITY\SYSTEM. No public proof-of-concept has been identified, but the technique class is well-understood within offensive tooling.