Loading vulnerability…
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2026-35418 is a local elevation-of-privilege vulnerability in the Windows Cloud Files Mini Filter Driver, a kernel-mode component that supports Windows cloud file synchronization features. The flaw is a use-after-free condition in cldflt.sys and is also associated with a time-of-check time-of-use race condition. Under concurrent execution, one kernel thread can continue using an object after another thread has freed it, creating a dangling pointer in kernel space. A locally authenticated attacker with low privileges can trigger the race and potentially reclaim the freed memory with controlled data, leading to arbitrary code execution in kernel context. Microsoft rated the issue Important and assigned it a CVSS v3.1 base score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows local privilege escalation to SYSTEM. Because the vulnerable component executes in kernel mode, exploitation can provide arbitrary code execution in kernel context and result in high impact to confidentiality, integrity, and availability of the affected system, including full machine compromise.
If you can’t patch tonight, do this now.
No separate workaround or configuration-based mitigation is currently available from Microsoft. Risk reduction depends on promptly applying the vendor-issued security updates and limiting opportunities for untrusted local users to obtain authenticated access to affected systems.
Patch, then assume compromise.
Apply the Microsoft security updates released on 2026-05-12 for affected Windows desktop and server versions. Microsoft provided official fixes through cumulative security updates, and for some supported editions also through Security Hotpatch Updates. Systems should be updated to the patched build level for the relevant Windows release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.