Loading vulnerability…
Elevation of Privilege in Windows Cloud Files Mini Filter Driver
CVE-2026-34337 is a local elevation-of-privilege vulnerability in the Windows Cloud Files Mini Filter Driver, a kernel-mode file system mini-filter used to support cloud-backed file synchronization features. The flaw is caused by a use-after-free condition and is also associated with a race condition in shared resource handling. An authenticated local attacker with low privileges can trigger the vulnerable condition and exploit the driver in kernel context to elevate privileges. The issue affects the Cloud Files Mini Filter Driver component and was addressed by Microsoft in the May 2026 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged local attacker to obtain SYSTEM-level privileges. Because the vulnerable component executes in kernel mode, exploitation can result in full compromise of the affected host, including high impact to confidentiality, integrity, and availability. An attacker could use the vulnerability as a reliable post-compromise privilege-escalation primitive after gaining an initial foothold on a Windows system.
If you can’t patch tonight, do this now.
No vendor workaround or configuration-based mitigation was provided. Risk reduction therefore depends primarily on prompt installation of the relevant Microsoft security updates and limiting opportunities for untrusted users or code to execute locally on affected systems.
Patch, then assume compromise.
Apply the Microsoft security updates released on 2026-05-12 for affected Windows versions. Systems should be updated to the patched builds provided through Microsoft's cumulative updates or hotpatch channels for the relevant supported Windows 10, Windows 11, and Windows Server releases. The vendor identified the remediation as an official fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.