CVE-2026-34337

What it actually does

CVE-2026-34337 is a local elevation-of-privilege vulnerability caused by a use-after-free race condition in the Windows Cloud Files Mini Filter Driver, commonly associated with cldflt.sys. A low-privileged authenticated user who can execute code on an affected Windows workstation or server can trigger unsafe object lifetime handling in the kernel-mode file-system filter driver. Successful exploitation can corrupt kernel memory and allow the attacker to execute code with NT AUTHORITY\SYSTEM-level privileges, enabling full local control of the affected host. The flaw is not a standalone remote-code-execution issue; it requires prior local access or the ability to run a malicious program on the target system.

Why it matters to the business

If exploited, this vulnerability can turn an initial low-privilege foothold into complete control of a Windows endpoint or server. That can allow attackers to disable security tools, steal credentials, dump sensitive data, install persistence, move laterally, or deploy malware. The CVSS score of 7.8 reflects high impact once local execution is achieved, but current public exploitation signals are low: EPSS is approximately 0.00163, the 30-day EPSS trend is flat, it is not listed in CISA KEV, and no mature public exploit is indicated. Because the affected product set spans many supported Windows 10, Windows 11, and Windows Server releases, organizations should still treat patching as important across endpoint and server fleets.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system, for example through phishing, malware execution, abuse of a legitimate user account, or exploitation of a separate initial-access vulnerability. The attacker then runs a specially crafted local program that interacts with Cloud Files functionality exposed through the Windows file-system stack. By carefully timing file or placeholder operations, the program attempts to win a race condition in the Cloud Files Mini Filter Driver and cause a previously freed kernel object to be reused. If exploitation is reliable, the attacker uses the resulting kernel memory corruption to modify process privileges or security tokens, escaping from a normal user context to NT AUTHORITY\SYSTEM. After privilege escalation, the attacker can install services, tamper with endpoint defenses, access protected credentials, and use the compromised host as a launch point for further activity.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-34337 on all affected Windows versions, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019, Windows Server 2022 including 23H2, and Windows Server 2025. Reboot systems after patching where required so the updated kernel driver is loaded. Because exact fixed build numbers were not provided, use Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Security Update Guide to identify the applicable cumulative update for each OS release. Where immediate patching is not possible, reduce the likelihood of local exploitation by limiting interactive logon rights, enforcing application control such as Windows Defender Application Control or AppLocker, blocking untrusted executables from user-writable paths, ensuring EDR tamper protection is enabled, and restricting administrative tooling to trusted users. Disabling or altering the Cloud Files driver should only be considered as a temporary mitigation on systems where cloud placeholder/sync functionality is not required, because it can disrupt OneDrive or other cloud file provider behavior.

How to confirm the fix worked

Confirm exposure by inventorying Windows assets and identifying affected OS releases. Confirm remediation by verifying that the relevant post-fix cumulative update is installed and that the system has rebooted after installation. On individual hosts, use tools such as Windows Update history, Get-HotFix, DISM package inventory, Intune/Configuration Manager compliance reports, vulnerability scanner results, or EDR software inventory to confirm the applicable Microsoft security update is present. Validate that %SystemRoot%\System32\drivers\cldflt.sys is Microsoft-signed and has the expected version/date for the patched OS build. Also confirm that there are no unpatched unsupported Windows builds remaining in the fleet. For high-assurance validation, test representative patched and unpatched systems with an authenticated vulnerability scanner rather than relying only on OS version labels.

Typical attack path

1. Gain local code execution as a standard or otherwise low-privileged authenticated user on an affected Windows system.
2. Execute a crafted local exploit program that interacts with Cloud Files / placeholder file operations handled by the Cloud Files Mini Filter Driver.
3. Trigger the race condition that leads to use-after-free behavior in cldflt.sys.
4. Use the kernel memory corruption primitive to alter privileges, commonly by obtaining SYSTEM-level execution or modifying an access token.
5. Launch a SYSTEM shell, create a privileged service or scheduled task, disable defenses, dump credentials, or stage follow-on tools.
6. Use the elevated access for persistence, lateral movement, data access, or malware deployment.

How to detect it

There may be no clean, vulnerability-specific log entry for successful exploitation because the flaw occurs in a kernel-mode driver and may only appear as suspicious post-exploitation behavior. Review endpoint telemetry and Windows logs from affected systems for signs of local privilege escalation: a standard user process spawning SYSTEM-level processes, sudden creation of services or scheduled tasks, new local administrators, security-tool tampering, credential dumping attempts, or unexpected child processes launched from user-writable paths. Relevant log sources include Windows Security events 4688, 4672, 4624, 4697, 4698, 4720, 4728, 4732, 7045 from the System log via Service Control Manager, PowerShell Operational logs, Sysmon events 1, 6, 7, 10, 11, 12, 13, and 15 where deployed, EDR process lineage, driver load telemetry, crash dumps, Windows Error Reporting, and memory-forensic artifacts. Also review crash or bugcheck data for references to cldflt.sys, because failed exploitation attempts against a use-after-free kernel bug may cause system instability or blue-screen events. Treat cldflt.sys crashes as suspicious only when correlated with unusual local user activity, recently executed unknown binaries, or immediate privileged follow-on actions.

• cldflt.sys
• CldFlt
• Cloud Files Mini Filter Driver
• %SystemRoot%\System32\drivers\cldflt.sys
• \SystemRoot\System32\drivers\cldflt.sys
• Faulting module name: cldflt.sys
• Probably caused by : cldflt.sys
• SERVICE_NAME: CldFlt
• The CldFlt service failed
• BugCheck
• Windows Error Reporting
• Service Control Manager event ID 7045
• Security event ID 4697
• Security event ID 4672
• Security event ID 4688

What your security team should do

• Prioritize patch deployment to internet-facing jump hosts, VDI endpoints, developer workstations, administrator workstations, file servers, and systems where untrusted users can execute code.
• Include this vulnerability in the next Windows cumulative update compliance campaign, even though current EPSS is low and it is not in CISA KEV.
• Hunt for suspicious local privilege escalation behavior, especially low-privileged user processes that quickly create SYSTEM services, scheduled tasks, privileged shells, or security-tool tampering events.
• Restrict execution from user-writable directories and temporary folders using application control, attack surface reduction rules, and EDR policy controls.
• Review local administrator group changes, new service creation, scheduled task creation, and credential dumping alerts on affected Windows systems during the period before patch deployment.
• Ensure EDR and Windows event logging capture process creation, command line, service creation, scheduled task creation, driver load, PowerShell, and security log events.
• Where patching is delayed, reduce local attack surface by limiting interactive access and removing unnecessary user privileges on servers.
• Monitor Microsoft guidance for any later change in exploit maturity, public proof-of-concept availability, or KEV inclusion that would increase urgency.