Loading vulnerability…
CVE-2024-30085 is a local elevation-of-privilege vulnerability in the Microsoft Windows Cloud Files Mini Filter Driver, cldflt.sys. The flaw is a heap-based buffer overflow in the HsmIBitmapNORMALOpen code path, where the driver allocates a fixed-size 0x1000-byte paged-pool buffer and copies attacker-controlled reparse-point-derived data into it without properly constraining the copy length. By supplying crafted cloud-file reparse point data that passes the driver’s validation logic, a local attacker can trigger an out-of-bounds write in kernel memory. Public technical analysis describes exploitation by corrupting adjacent kernel heap objects, including WNF state data and other sprayed structures, to obtain kernel memory disclosure and arbitrary read/write primitives, culminating in privilege escalation to SYSTEM. Microsoft addressed the issue by adding bounds validation to ensure the copy size does not exceed the allocated buffer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (modules/exploits/windows/local/cve_2024_30085_cloud_files.rb) that exploits CVE-2024-30085, a heap overflow vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The exploit targets Windows 10 (1809 through 22H2), Windows 11 (21H2 through 23H2), and Windows Server 2022 (to 22_23H2) systems running the vulnerable driver. The module requires an existing Meterpreter or shell session on the target and leverages reflective DLL injection to execute a payload (typically a Meterpreter shell) in a newly spawned Notepad process, escalating privileges to SYSTEM. The code includes version checks to ensure compatibility and uses standard Metasploit libraries for privilege escalation and process manipulation. No network endpoints are present; the attack vector is local privilege escalation via a vulnerable driver. The repository is operational and ready for use within the Metasploit framework.
This repository contains a Python proof-of-concept (PoC) exploit for CVE-2024-30085, a local privilege escalation vulnerability in Microsoft Windows. The main exploit file, CVE202430085.py, simulates interaction with a vulnerable device or driver via the Windows API (CreateFileW and DeviceIoControl). The script attempts to open a handle to a device at \\.\vulnerable_device and sends a specific control code (0x222003) to trigger the vulnerability. If successful, it launches a command shell (cmd.exe) with elevated privileges. The exploit requires local access as a standard user on a vulnerable Windows system. The repository also includes a detailed explanation of the vulnerability and exploitation steps (Explicacion.txt) and a README summarizing the exploit's purpose. No network endpoints are present; the attack vector is local, targeting a device or driver accessible on the Windows system.
This repository contains a proof-of-concept (PoC) exploit for CVE-2024-30085, a heap-based buffer overflow vulnerability in the Windows cloud filter driver (cldflt.sys) affecting Windows 11 23H2. The exploit is implemented in C++ across two main files: 'main.cpp' (the core exploit logic) and 'main.h' (definitions and structures). The exploit leverages low-level Windows APIs and ALPC (Advanced Local Procedure Call) primitives to manipulate kernel memory and escalate privileges. Upon successful exploitation, it spawns a new command prompt (cmd.exe) with SYSTEM privileges, demonstrating local privilege escalation. The exploit requires local execution on a vulnerable Windows 11 23H2 system and does not target network services. Notable hardcoded file paths include the payload path ('C:\Windows\System32\cmd.exe') and target directories used during exploitation. The repository is a standalone PoC and not part of any exploit framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heap buffer overflow vulnerability in Windows cldflt.sys that can be exploited for local privilege escalation to SYSTEM; the article also describes a variant enabling PPL bypass and LSASS credential extraction.
A heap buffer overflow vulnerability in Windows discussed in the context of local kernel exploitation to elevate privileges from a regular user to SYSTEM, including use of I/O Ring, WNF, ALPC, and pipe attribute techniques.
A heap buffer overflow vulnerability discussed in the context of Windows local privilege escalation from a regular user to SYSTEM using ALPC with token stealing or I/O Ring techniques.
A specific vulnerability referenced only in related/next-post links, not discussed in the main content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.