Windows Cloud Files Mini Filter Driver: Use after free allows privilege escalation
Summary
A use-after-free flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authorized local user to elevate privileges. An attacker who already has local access and low-privileged credentials could gain higher rights, potentially up to full control of the system. Microsoft fixed the flaw in the October 13, 2026 security update and rates it Important.
Affected
- Windows 10 Version 1809: builds before 10.0.17763.9376
- Windows 10 Version 21H2: builds before 10.0.19044.7807
- Windows 10 Version 22H2: fixed build Unknown, verify on the MSRC advisory
- Windows 11 Version 23H2: builds before 10.0.22631.7652
- Windows 11 Version 24H2: builds before 10.0.26100.9711
- Windows 11 Version 25H2: builds before 10.0.26200.9711
- Windows 11 Version 26H1: builds before 10.0.28000.3231
- Windows 11 Version 26H2: builds before 10.0.26300.9711
- Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
- Windows Server 2022: builds before 10.0.20348.5761
- Windows Server 2025 (including Server Core): builds before 10.0.26100.33650
Fixed in
- Security update released October 13, 2026. The fixed builds are the minimum builds listed above.
- Windows 10 Version 22H2: Unknown.
- KB article numbers: Unknown, see the MSRC advisory.
Workaround
- No Microsoft workaround known. Install the security update.
- Disabling cldflt.sys is reported only for the related MiniPlasma issue. It is not verified for this CVE and breaks OneDrive Files On-Demand, so do not apply it without testing.
Exploitation
- Microsoft rates exploit code maturity as Unproven.
- No public exploit code or in-the-wild exploitation found for this CVE. No CISA KEV listing found in the sources checked.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- A related MiniPlasma issue in the same driver has public proof-of-concept code. It is not confirmed to be the same bug.
Our recommendation
- Install the October 13, 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems.
- Check whether Windows 10 Version 1809 and 21H2 machines still receive updates, as these versions are out of mainstream support.
- Verify fixed builds on the MSRC advisory, especially for Windows 10 Version 22H2.
- Monitor for public exploit code for CVE-2026-83696 and for MiniPlasma-related updates.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Cloud Files Mini Filter Driver
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83696 msrc.microsoft.com
- Vulners: CVE-2026-83696 (CNA record) vulners.com
- Strix: CVE-2026-83696 www.strix.ai
- CVE mirror: Official fix status cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:34.
Original description (NVD)
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.