OnlyPatch
Windows Cloud Files Mini Filter Driver

CVE-2026-69279 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Important CVSS 7 🔬 Patch diffed 2026-09 archive

Executive Summary

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Sep 8 2026
Last Updated Sep 8 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known

CVSS Vector

ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

22 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1809 for 32-bit Systems 5122876 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5122876 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5122878 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5122880 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5122880 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5124008 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5124008 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5124008 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5124008 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 26H1 for ARM64-based Systems 5124012 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5124012 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5122876 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5122876 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5122882 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5122882 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5122871 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5122871 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5122876 Security Update Yes
5122878 Security Update Yes
5122880 Security Update Yes
5124008 Security Update Yes
5124012 Security Update Yes
5122882 Security Update Yes
5122871 Security Update Yes

Patch Diff

ghidriff · cldflt.sys (KB5124008)

Use-after-free (CWE-416) in the Windows Cloud Files Mini Filter Driver cldflt.sys request timeout/countdown-timer path, local elevation of privilege to SYSTEM via a race condition (Important, EoP, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CVSS 7.0; Exploitation Unlikely per MSRC). cldflt arms a per-stream countdown timer (CldiStreamStartCountdownTimer) whose worker (CldiStreamTimeoutWorker) expires and completes/cancels pending stream requests via the global request list (CldiStreamInsertIntoGlobalRequestListNoLock / CldiStreamRemoveFromGlobalRequestListNoLock, CldiStreamIsRequestExpired, TlmWriteFltTimeout). PRE: the timeout-driven completion path raced with normal request completion/cancellation over the same CLD_STREAM_REQUEST object without a consistent CDQ-lock discipline, so a request could be freed on one path and still be used (dereferenced/completed) on the timeout path - a use-after-free of a stream request in kernel context, giving a SYSTEM elevation primitive to an attacker who wins the race (AC:H). Diff of cldflt.sys 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: gated behind CFR flag Feature_3750208824, CldiStreamStartCountdownTimer is rewritten (length 486 -> 981) to route completion through the same locked non-CDQ helpers introduced for the abort path (CldiCanDoNonCdqCompletion, CldiStreamCdqRELEASE, CldiStreamCompleteCanceledRequest, CldiStreamPrepareRequestForNonCdqCompletion) under CDQ acquire/release, so the timer path no longer completes a request that another path may have freed. Attribution note: this is the third and last distinct fix cluster in the Aug->Sep cldflt diff. It is deduced by elimination and by mechanism: CVE-2026-80093 is the CfAbortOperation race in CldStreamAbortOperation (Feature_544180536, confirmed by Talos TALOS-2026-2445) and CVE-2026-83991 is the CfCreatePlaceholders supersede access-check (Feature_1245077819, confirmed by public PoC); the remaining Feature_3750208824-gated timeout/countdown-timer UAF cluster - the last functions in the diff, ending at CldiStreamIsRequestExpired - is therefore CVE-2026-69279, the second CWE-416 use-after-free in the September cldflt advisory (MSRC rates it Exploitation Unlikely, consistent with a race against the kernel timeout worker being harder to win than the on-demand CfAbortOperation trigger). No public technical report exists for CVE-2026-69279 to cross-check the exact object lifetime; the fix mechanism and gate are isolable, but the specific freed allocation was not independently traced.

Pre-patch version 10.0.26100.9278 Download
Post-patch version 10.0.26100.9444 Download
Function Address Change Note
CldiStreamStartCountdownTimer code change code (timeout completion routed through locked non-CDQ helpers, CFR-gated) Rewritten (length 486 -> 981; ratio 0.24). Post (Feature_3750208824): gains calls to CldiCanDoNonCdqCompletion, CldiStreamCdqRELEASE, CldiStreamCompleteCanceledRequest and CldiStreamPrepareRequestForNonCdqCompletion so the timer/worker path completes requests under the same CDQ-lock discipline as the abort path, closing the timeout-vs-completion UAF race. Pre: the old path (gated off when Feature_3750208824 disabled) completed timed-out requests without that lock discipline.
CldiStreamIsRequestExpired / TlmWriteFltTimeout code change code (timeout bookkeeping in the countdown path) Request-expiry test and filter-timeout write used by the countdown-timer worker; adjusted so expiry/cancel decisions happen under the locked completion path. CldiStreamIsRequestExpired is the last changed function in the diff.
CldiStreamInsertIntoGlobalRequestListNoLock / CldiStreamRemoveFromGlobalRequestListNoLock code change code (shared global-request-list helpers) Global pending-request list insert/remove used by both the timeout and abort paths; updated so a request is detached from the list before it can be completed/freed on the timer path.
CldiCanDoNonCdqCompletion / CldiStreamCdqACQUIRE / CldiStreamCdqRELEASE / CldiStreamCompleteCanceledRequest code change code (shared locked-completion helpers, also used by CVE-2026-80093 fix) The same non-CDQ completion helpers hardened for the abort fix are now driven by the timer path under Feature_3750208824, giving both UAF fixes a single consistent lock discipline.
Feature_3750208824 gate added (CFR gate) CFR flag gating the timeout/countdown-timer completion restructure; the original unlocked timeout completion ships when disabled. Distinct from Feature_544180536 (CVE-2026-80093 abort path) and Feature_1245077819 (CVE-2026-83991 placeholders access check).
View full diff report View RCA report

Attack Path

The stream request-timeout worker races normal completion over the same request object, freeing it on one path and using it on the other

Attack path for CVE-2026-69279 The stream request-timeout worker races normal completion over the same request object, freeing it on one path and using it on the other 01 — ENTRY Local attacker drives cloud-file stream requests that arm the countdown timer cldflt arms a per-stream countdown timer (CldiStreamStartCountdownTimer); its worker expires pending requests. AV:L / PR:L / UI:N, AC:H (a race must be won). 02 — CONTROLLED INPUT Force a pending request to time out while it is also being completed/cancelled The timeout worker and the normal completion/cancel path both act on the same CLD_STREAM_REQUEST via the global request list. 03 — MISSING CHECK Timeout path completes a request another path already freed (CWE-416) Pre-patch the two paths lacked a consistent CDQ-lock discipline, so the request object could be freed on one path and still dereferenced/completed on the timeout path - a use-after-free in kernel context. 04 — IMPACT Kernel use-after-free -> SYSTEM (race-dependent) Winning the race yields a controlled kernel UAF and elevation to SYSTEM (Important, 7.0; MSRC rates exploitation Unlikely due to the race requirement).

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

AIフィジカルインターフェイス二号機
haowei yan & xiaozun tang

On This Page