CVE-2026-80093 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Executive Summary

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Overview

7

CVSS HIGH

Important

MS Severity

Not Exploited

MS Exploit Status

More Likely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-416: Use After Free

Released Sep 8 2026

Last Updated Sep 8 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

CVSS Vector

ATTACK VECTOR

Local

ATTACK COMPLEXITY

High

PRIVILEGES REQUIRED

Low

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 6.1

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

22 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1809 for 32-bit Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for x64-based Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for x64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 version 26H1 for x64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019 (Server Core installation)	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022 (Server Core installation)	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025 (Server Core installation)	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes

Patches

7 patches

Article	Type	Restart
`5122876`	Security Update	Yes
`5122878`	Security Update	Yes
`5122880`	Security Update	Yes
`5124008`	Security Update	Yes
`5124012`	Security Update	Yes
`5122882`	Security Update	Yes
`5122871`	Security Update	Yes

Patch Diff

ghidriff · cldflt.sys (KB5124008)

Use-after-free / type confusion (CWE-416; researcher classifies CWE-843) in the Windows Cloud Files Mini Filter Driver cldflt.sys request-abort path, local elevation of privilege to SYSTEM via a race condition (Important, EoP, AV:L/AC:H/PR:L/UI:N, MSRC CVSS 7.0; Talos rates 8.8 with Scope:Changed). CldStreamAbortOperation walks the per-stream OpenStream->RequestListHead and, for each entry, computes request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry) (entry - 0x8). Because the CDQ lock is released inside the loop, a concurrent thread running CldiStreamProcessPendingHydrationRequests can insert a stack-based LIST_ENTRY sentinel into the same intrusive list; the abort walker then treats that sentinel as an embedded request object, fabricating a fake CLD_STREAM_REQUEST_PARTIAL backed by another thread's kernel stack and later dereferencing its fields and writing through a fake QueueContext pointer - a kernel write primitive / UAF. The condition is reached by registering a provider, creating a dehydrated placeholder, triggering OnFetchData without responding (leaving a pending request), then calling the undocumented CfAbortOperation with wildcard-zero keys (ProviderKey/SyncRootKey/StreamKey/RequestKey = 0) so \CLDMSGPORT's CldiPortProcessAbortHydration (0x4002) -> CldSyncAbortOperation -> CldStreamAbortOperation repeatedly walks every stream's request list. Diff of cldflt.sys 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: gated behind CFR flag Feature_544180536, CldStreamAbortOperation / CldiStreamCompleteRequest / CldStreamClose / CldStreamHasPendingRequests / CldiStreamPrepareRequestForNonCdqCompletion are restructured to complete/cancel requests under a consistent CDQ-lock discipline (CldiStreamPrepareRequestForNonCdqCompletion + CldiCanDoNonCdqCompletion gating before CldiStreamCompleteCanceledRequest), removing the unlocked list-walk window that allowed the stack sentinel to be mis-cast. Confirmed against the Talos public report TALOS-2026-2445, which names CldStreamAbortOperation, CldiStreamPrepareRequestForNonCdqCompletion and the CfAbortOperation trigger; the feature gate Talos shows inside CldStreamAbortOperation (mis-symbolized as Feature_H2E_WPA3SAE) corresponds to Feature_544180536 in this ghidriff. Note: Microsoft classifies this CWE-416 (Use After Free) with CVSS 7.0 / Scope:Unchanged; Talos classifies it CWE-843 (Type Confusion) with CVSS 8.8 / Scope:Changed - the same bug described as a sentinel mis-cast that yields a UAF-style controlled dereference/write.

Pre-patch version 10.0.26100.9278 Download

Post-patch version 10.0.26100.9444 Download

Function	Address	Change	Note
`CldStreamAbortOperation`	`code change`	code (request-abort list walk restructured under CDQ lock, CFR-gated)	Pre: walked OpenStream->RequestListHead computing CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry) with the CDQ lock released inside the loop; a concurrently inserted stack LIST_ENTRY sentinel (from CldiStreamProcessPendingHydrationRequests) was mis-cast into a fake request on another thread's stack. Post (Feature_544180536): completes/cancels via CldiStreamPrepareRequestForNonCdqCompletion + CldiCanDoNonCdqCompletion under a consistent lock, closing the unlocked-walk race. This is the function Talos names for CVE-2026-80093.
`CldiStreamPrepareRequestForNonCdqCompletion`	`code change`	code (new/rewritten locked completion helper, CFR-gated)	Prepares a request for completion outside the CDQ; used by the abort path so a request is validated/detached under lock before CldiStreamCompleteCanceledRequest, rather than dereferenced straight from an unlocked list entry.
`CldiCanDoNonCdqCompletion / CldiStreamCompleteCanceledRequest`	`code change`	code (gated completion decision + cancel path)	CldiCanDoNonCdqCompletion decides whether the request can be completed off the CDQ; CldiStreamCompleteCanceledRequest performs the cancel (STATUS 0xC000CF16). The abort loop now gates on these under Feature_544180536 instead of casting every raw list entry.
`CldStreamClose / CldiStreamCompleteRequest / CldStreamHasPendingRequests`	`code change`	code (same locked-completion discipline applied to the close/complete paths)	Sibling request-completion entry points hardened with the same Feature_544180536-gated lock discipline so a request object cannot be completed twice or walked after free.
`Feature_544180536`	`gate`	added (CFR gate)	CFR flag gating the abort/complete lock restructure; the original unlocked list-walk ships when disabled. Talos shows this gate inside CldStreamAbortOperation (mis-symbolized by Ghidra as Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1).

View full diff report View RCA report

Attack Path

A wildcard CfAbortOperation makes CldStreamAbortOperation walk a request list with an unlocked window, mis-casting a stack sentinel into a fake request object

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

Marcin 'Icewall' Noga
yhw & txz

References

MSRC Advisory MITRE NVD