Windows Cloud Files Mini Filter Driver: Local privilege escalation

Summary

The Windows Cloud Files Mini Filter Driver (cldflt.sys) contains an out-of-bounds read (CWE-125). An authenticated local user with low privileges can exploit it to gain SYSTEM-level privileges. The attack requires local access and a valid user session; the vulnerability is not directly reachable from the internet.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Install the November 2026 cumulative updates from Microsoft (builds listed above as the first non-affected versions).
• Verify the exact build numbers for your version on the MSRC Security Update Guide before rollout, as the NVD entry is still awaiting analysis.

Workaround

• No workaround from Microsoft for this CVE. Patching is the fix.
• Third-party sources suggest disabling the Cloud Filter driver (cldflt service) if OneDrive Files On-Demand and other sync features are not needed. This is not from the Microsoft advisory, breaks sync features and must be tested first.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public exploit code or PoC known for this CVE.
• Rapid7 reports Microsoft is aware of in-the-wild exploitation for one of the November 2026 vulnerabilities, but does not name it. Whether this CVE is that one is unknown.
• A different cldflt.sys vulnerability (CVE-2025-62221) is known to be exploited in the wild; this is a separate issue.

Our recommendation

• Apply the November 2026 security updates to all affected workstations and servers, with priority on multi-user systems, Remote Desktop and terminal servers, and machines with OneDrive sync clients.
• Verify the installed build numbers after patching.
• Monitor for changes in exploitation status and for public exploit code.
• Restrict local logon to trusted users where possible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105569 msrc.microsoft.com
• CVE.org Record: CVE-2026-105569 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva KB 5132059 senserva.com
• Lilting: MiniPlasma Windows cldflt zero-day lilting.ch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:32.