Windows Cloud Files EUVD-2026-99953

Exploitation requires local, authenticated access with the ability to execute code on the target (PR:L, AV:L) - there is no remote or network-facing path. The attacker must interact with the Windows Cloud Files Mini Filter Driver (cldflt.sys), the component underpinning Files On-Demand / OneDrive placeholder (reparse point) functionality, which is present by default across supported Windows 10, Windows 11, and Windows Server builds. The key limiting factor is the high attack complexity (AC:H): as a use-after-free, successful exploitation almost certainly depends on winning a kernel race condition to reuse the freed object, making reliable exploitation difficult and potentially requiring repeated attempts. No user interaction is required (UI:N), and no non-default configuration is needed since the driver is a standard OS component.

This is a locally-exploitable kernel elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), carrying a vendor CVSS of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals paint a consistent moderate-priority picture rather than an emergency: the local attack vector (AV:L) and required low privileges (PR:L) mean an attacker must already have authenticated code-execution on the host, and the high attack complexity (AC:H) - typical of use-after-free bugs that require winning a kernel race condition - further limits reliable exploitation. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The full-triad impact (C:H/I:H/A:H) is accurate for a kernel UAF that yields SYSTEM. Net: this is a credible local privilege-escalation primitive valuable as a second-stage/post-compromise tool, but not a remotely-exploitable or mass-exploitable issue. Note a minor conflict to verify: the input Tags include 'Denial Of Service' while the description and CVSS (I:H) describe privilege elevation, not availability loss - the EoP framing from Microsoft should be treated as authoritative.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a chained RCE) runs a crafted program that manipulates Cloud Files / Files On-Demand operations to trigger a use-after-free in the cldflt.sys kernel driver. By winning the required race condition and reclaiming the freed object, they corrupt kernel memory to execute code as SYSTEM. No public exploit was identified in the provided data, and the high attack complexity means exploitation is non-trivial and may require multiple attempts.