Introduction
A use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, disclosed in Microsoft's May 2026 Patch Tuesday, gives any low-privilege local user a path to SYSTEM-level access with no user interaction required. Windows holds over 31 percent of the North American operating system market, and the affected driver (cldflt.sys) supports cloud sync features like OneDrive and Windows 365, so the exposure across enterprise environments is significant.
Technical Information
CVE-2026-33835 is a use-after-free condition (CWE-416) in the Windows Cloud Files Mini Filter Driver, specifically the cldflt.sys kernel-mode component. Use-after-free vulnerabilities occur when a program keeps referencing memory after that memory has been deallocated. An attacker who can manipulate the contents of the freed region can use it to achieve arbitrary code execution or privilege escalation.
CVSS Metrics
The full CVSS 3.1 vector string is:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value | Significance |
|---|---|---|
| Base Score | 7.8 | High severity local privilege escalation |
| Temporal Score | 6.8 | Reduced due to official fix availability |
| Attack Vector | Local | Requires local system access |
| Attack Complexity | Low | No special conditions needed |
| Privileges Required | Low | Standard user account sufficient |
| User Interaction | None | Exploitable solely at the attacker's discretion |
| Scope | Unchanged | Impact confined to the vulnerable component's authority |
| Confidentiality / Integrity / Availability | High / High / High | Full compromise of the local security boundary |
Attack Flow
Exploitation follows a pattern common to kernel-mode use-after-free flaws:
-
Initial access: The attacker first needs local, low-privilege access to a Windows system where the Cloud Files Mini Filter Driver is loaded. The driver is present on systems that use cloud file synchronization features such as OneDrive or Windows 365.
-
Triggering the use after free: The attacker crafts specific I/O request patterns or IOCTL calls aimed at the
cldflt.sysminifilter driver. These requests drive the driver down a code path where a memory object is freed but a dangling reference to it persists. -
Memory manipulation: Once the memory is freed, the attacker reclaims the region with attacker-controlled data. Because
cldflt.sysruns in kernel mode, corrupting this memory can let the attacker hijack execution flow at the kernel level. -
Privilege escalation to SYSTEM: Microsoft confirms that successful exploitation grants SYSTEM privileges, which is a complete compromise of the local security boundary. The attacker could then install software, access all data on the system, create new accounts, or pivot further into the network.
With low attack complexity and no user interaction needed, an attacker who has a foothold can exploit the flaw entirely at their own discretion.
Microsoft credited Joe Desimone of Elastic Security with the coordinated vulnerability disclosure of this issue.
Detection Methods
Snort IDS/IPS Signatures
Cisco Talos published dedicated IDS/IPS signatures for CVE-2026-33835 on May 12, 2026, the same day the vulnerability was disclosed. The rule identifiers are:
- Snort 2: GID 1, SID 66438 and SID 66439
- Snort 3: GID 1, SID 301494
All rules carry the alert message OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt and belong to the os-windows rule group.
In the Snort 2 rule packs, both SID 66438 and SID 66439 ship disabled by default. Organizations relying on Snort 2 must enable these rules in their local policy configuration before they will fire. Snort 3 deployments should also confirm that SID 301494 is active.
The rules are available across a wide range of Snort engine versions: Snort 2 packs for versions 2091701, 2091801, and 2092000, and Snort 3 packs spanning versions 3.1.11.0 through 3.12.0.0. Most current deployments should be able to pull them from the latest subscriber rule update. An active Cisco Talos Snort Subscriber Ruleset subscription is required. Updates are distributed through Snort.org rule packs and Cisco Secure Firewall (formerly Firepower) management consoles.
Host-Based Detection Guidance
CVE-2026-33835 is a local elevation of privilege vulnerability, and an attacker already needs local low-privilege access to exploit it, so network-based signatures alone may not give full visibility. Complementary host-based detection is critical.
Security teams should consider monitoring for the following behavioral indicators:
Unexpected privilege escalation to SYSTEM: Microsoft confirms that successful exploitation grants SYSTEM privileges, so processes that unexpectedly acquire SYSTEM-level tokens are a strong detection signal. Watch the Windows Security Event Logs (Event IDs 4672 and 4624 for special privilege logon events) for them. EDR tools that track token manipulation and privilege changes at the process level are well suited to this.
Anomalous interaction with the Cloud Files Mini Filter Driver: The cldflt.sys minifilter driver is loaded to support Windows cloud file synchronization. Unusual I/O request patterns or IOCTL calls targeting this driver may indicate exploitation, especially when they come from processes that would not normally touch cloud sync subsystems. Kernel driver audit logs and Sysmon (Event ID 6 for driver loads, Event ID 1 for process creation) can help surface these anomalies.
Process lineage analysis: A hallmark of local EoP exploitation is a low-privilege process spawning child processes that run as SYSTEM. SIEM correlation rules or EDR detections that flag these parent/child privilege boundary violations, particularly where the parent process has recently interacted with minifilter driver components, would make a strong post-exploitation detection layer.
No public file-hash-based IoCs, IP-based indicators, or standalone YARA rules for CVE-2026-33835 have been published as of this writing. The Talos Snort signatures are still the only vendor-released, CVE-specific detection signatures available.
Affected Systems and Versions
The vulnerability affects the Windows Cloud Files Mini Filter Driver (cldflt.sys) across Windows operating systems. The publicly available excerpts of Microsoft's Security Update Guide advisory do not list specific Windows versions. Administrators should check the Microsoft Security Update Guide product matrix for CVE-2026-33835 to identify every affected Windows edition and version in their environment. The driver is present on systems that support cloud file synchronization features, including those using OneDrive and Windows 365.
Vendor Security History
Microsoft fixed CVE-2026-33835 in the May 2026 Patch Tuesday cycle, which addressed between 120 and 137 vulnerabilities across Microsoft products, with up to 31 marked as critical. None of the vulnerabilities in this release were observed as actively exploited zero-days at the time of publication.
References
- Microsoft Security Update Guide: CVE-2026-33835
- NVD Entry for CVE-2026-33835
- Microsoft Patch Tuesday for May 2026, Cisco Talos Intelligence
- The May 2026 Security Update Review, Zero Day Initiative
- Snort Subscriber Rules Update 2026-05-12
- Talos Rules Advisory 2026-05-12
- Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days, BleepingComputer
- Operating System Market Share North America, StatCounter
