Brief Summary: CVE-2026-35418 Windows Cloud Files Mini Filter Driver Use After Free Privilege Escalation

Introduction

A use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver now gives any locally authenticated user a reliable path to SYSTEM privileges. It needs only low-privilege access and no user interaction. The flaw, CVE-2026-35418, affects 17 distinct Windows product versions across desktop and server, and this exact driver has been actively exploited before. Security teams managing Windows estates should give it prompt attention.

Technical Information

The Vulnerable Component: cldflt.sys

The Windows Cloud Files Mini Filter Driver, cldflt.sys, is a kernel-mode minifilter at the core of the storage stack in the Windows cloud files API. It acts as a proxy between user applications and sync engines, and works directly with the Windows Shell so that cloud data appears locally available on NTFS volumes. This driver underpins features like OneDrive Files On Demand and is loaded on virtually every modern Windows installation that uses cloud file synchronization.

Root Cause: TOCTOU Race Leading to Use After Free

Microsoft associates two weaknesses with this flaw: CWE-416 (Use After Free) and CWE-367 (Time of Check Time of Use Race Condition). The bug appears when one kernel thread validates an object managed by the minifilter and begins operating on it, while a concurrent thread causes that same object to be freed. The first thread then keeps referencing the now-freed memory through a dangling pointer.

Because cldflt.sys runs in kernel space, corrupting memory through this dangling pointer dereference can yield arbitrary code execution at the highest privilege level. The CVSS 3.1 vector string:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

This translates to a base score of 7.8 and a temporal score of 6.8. Local access is required, but attack complexity is low, only low privileges are needed, and no user interaction is necessary. Impact is high for confidentiality, integrity, and availability.

Attack Flow

Exploitation of CVE-2026-35418 follows a post-compromise privilege escalation pattern:

1. The attacker obtains a low-privilege session on the target system by any means, such as phishing, credential theft, or exploitation of another vulnerability.
2. The attacker crafts operations against the Cloud Files Mini Filter Driver that open a race window between the validation (time of check) and the use (time of use) of a kernel object.
3. A concurrent thread frees the object inside that window, leaving the first thread holding a dangling pointer.
4. The attacker reclaims the freed memory with controlled data, a standard technique in kernel use-after-free exploitation.
5. When the driver dereferences the dangling pointer and operates on the attacker-controlled data, the attacker gets arbitrary code execution in kernel context and escalates to SYSTEM.

Because attack complexity is low and no user interaction is required, this is a highly reliable escalation primitive once the attacker has initial access.

Patch Information

Microsoft released an official fix for CVE-2026-35418 on May 12, 2026, as part of its May 2026 Patch Tuesday cycle. Because cldflt.sys is a closed-source Windows kernel driver, no public source code diff is available. The fix ships only in cumulative Windows security updates, delivered through Windows Update and the Microsoft Update Catalog.

Conceptually, the patch almost certainly addresses the TOCTOU race by adding proper synchronization or reference count management around the object lifecycle in the Cloud Files Mini Filter Driver. The fix would hold the object with an additional reference (or protect it with a lock) for the entire operation, which closes the race window that previously allowed the dangling pointer dereference.

Microsoft lists every affected product with a customer action of "Required," meaning the patch must be deployed, manually or automatically, through Windows Update or WSUS.

For several server editions and for Windows 11 24H2/25H2, Microsoft provides both a standard cumulative update and a Security Hotpatch Update. The hotpatch mechanism applies the fix in memory without an immediate reboot, which is especially useful in production server environments.

Affected Systems and Versions

The vulnerability affects 17 distinct Windows product versions across desktop and server platforms, in the following configurations:

Windows 10:

• Version 1809: 32 bit Systems, x64 based Systems (builds prior to 10.0.17763.8755)
• Version 21H2: 32 bit Systems, ARM64 based Systems, x64 based Systems (builds prior to 10.0.19044.7291)
• Version 22H2: 32 bit Systems, ARM64 based Systems, x64 based Systems (builds prior to 10.0.19045.7291)

Windows 11:

• Version 22H3: ARM64 based Systems (builds prior to 10.0.22631.7079)
• Version 23H2: x64 based Systems (builds prior to 10.0.22631.7079)
• Version 24H2: ARM64 based Systems, x64 based Systems (builds prior to 10.0.26100.8457)
• Version 25H2: ARM64 based Systems, x64 based Systems (builds prior to 10.0.26200.8457)
• Version 26H1: ARM64 based Systems, x64 based Systems (builds prior to 10.0.28000.2113)

Windows Server:

• Windows Server 2019: x64 based Systems (builds prior to 10.0.17763.8755)
• Windows Server 2022: x64 based Systems (builds prior to 10.0.20348.5139)
• Windows Server 2022, 23H2 Edition (Server Core): x64 based Systems (builds prior to 10.0.25398.2330)
• Windows Server 2025: x64 based Systems (builds prior to 10.0.26100.32860)

Server Core installations of these Windows Server versions are also affected and need the same fixed builds.

Vendor Security History

CVE-2026-35418 itself is not currently exploited, but the cldflt.sys driver has been targeted before. In 2025, CVE-2025-62221, a similar use-after-free vulnerability in the same Windows Cloud Files Mini Filter Driver, enabled local privilege escalation to SYSTEM and was actively exploited in the wild. Threat actors have already built the expertise to weaponize vulnerabilities in this specific driver class, and they have used it in real-world attacks.

The May 2026 Patch Tuesday cycle addressed 120 vulnerabilities in total. Microsoft's monthly update cadence gives organizations a reliable way to remediate, but the volume of patches in each cycle means they need efficient testing and deployment workflows.

References

• CVE-2026-35418, Microsoft Security Update Guide
• CVE-2026-35418, NVD
• CVE Record: CVE-2026-35418
• CVE-2026-35418, Tenable
• Build a Cloud Sync Engine that Supports Placeholder Files, Microsoft Learn
• Microsoft Patch Tuesday May 2026, CybersecurityNews
• Microsoft May 2026 Patch Tuesday, SANS ISC
• Windows Cloud Files Mini Filter Driver Privilege Escalation (CVE-2025-62221), RedLegg
• Desktop Operating System Market Share Worldwide, StatCounter
• Microsoft Security Update Guide