Loading story…
Researchers detailed exploitation of two Windows Cloud Files Mini Filter Driver vulnerabilities in cldflt.sys—CVE-2021-31969 and CVE-2024-30085—that allow local attackers to escalate privileges to NT AUTHORITY\SYSTEM through kernel heap corruption. In the older bug, a missing lower-bound validation in HsmpRpiDecompressBuffer caused an integer underflow that led to a controlled paged-pool overflow during RtlDecompressBuffer processing. The issue affected Windows 10 1809-21H2 and Windows Server 2019, and could be triggered by registering a sync root, planting crafted cloud-file reparse data in a directory, and invoking filesystem operations such as opening a handle to that directory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a security update for CVE-2025-50170, a high-severity local privilege escalation flaw in cldflt.sys caused by a logic error during placeholder file creation. According to STAR Labs, the bug lets a low-privileged local attacker corrupt arbitrary files and potentially achieve SYSTEM-level code execution on affected Windows 10, Windows 11, and Windows Server systems.
STAR Labs published a detailed exploit write-up for CVE-2024-30085 describing how two heap overflows against WNF-related objects can be chained to leak kernel pointers, gain arbitrary read/write, and overwrite token privileges to spawn a SYSTEM shell. The analysis ties the bug to crafted cloud-file reparse point data in the Windows Cloud Files Mini Filter Driver.
Microsoft addressed CVE-2024-30085, a heap-based buffer overflow in cldflt.sys, in Windows 10 22H2 update KB5039211 by adding a check to ensure the attacker-controlled copy size does not exceed the 0x1000-byte allocation. The flaw could be triggered through crafted cloud-file reparse point data to achieve local privilege escalation.
STAR Labs released a technical analysis showing how CVE-2021-31969 can be exploited via crafted reparse data, filesystem-triggered decompression, and paged-pool corruption to obtain arbitrary read/write and steal the SYSTEM token. The write-up also notes the exploit was unreliable, succeeding roughly once every 15 attempts and often destabilizing the system.
Microsoft fixed CVE-2021-31969, an elevation-of-privilege flaw in the Windows Cloud Files Mini Filter Driver caused by missing lower-bound validation that could lead to a kernel pool overflow and SYSTEM-level code execution. The STAR Labs write-up identifies the bug as affecting Windows 10 1809-21H2 and Windows Server 2019.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple Windows local privilege escalation vulnerabilities affecting kernel-level drivers, including **Windows Common Log File System (CLFS) Driver** flaws tracked as `CVE-2023-23376` and `CVE-2023-28252`, as well as a **Windows Cloud Files Mini Filter Driver** flaw tracked as `CVE-2025-62454`. All three issues were classified as **Elevation of Privilege** vulnerabilities in Microsoft's Security Update Guide. The advisories indicate that successful exploitation could allow an attacker who already has access to a target system to gain higher privileges through vulnerable Windows driver components. The affected bugs span separate Windows subsystems but share the same core risk: attackers can abuse low-level driver weaknesses to move from limited access toward more powerful control over compromised machines, reinforcing the need to prioritize Microsoft security updates for Windows kernel and file-system-related components.
Jul 4, 2026
Microsoft released a security update in December 2025 addressing a critical privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver, tracked as CVE-2025-62221. This flaw allows authenticated local attackers to elevate privileges to SYSTEM by exploiting a use-after-free condition in the kernel driver, which arises when the driver fails to reset a pointer after releasing a kernel object. The vulnerability has a CVSS score of 7.8 and has been actively exploited in the wild, prompting urgent patching recommendations from security researchers and vendors. The December 2025 Patch Tuesday included fixes for 57 vulnerabilities across Microsoft products, but CVE-2025-62221 was highlighted as one of the most severe due to its exploitation status and potential impact on enterprise environments. Security advisories emphasized the need for immediate patching, as the vulnerability was included in CISA's Known Exploited Vulnerabilities catalog and listed among the most exploited vulnerabilities of the year. Organizations are urged to apply the update promptly to mitigate the risk of privilege escalation attacks leveraging this flaw.
Jun 29, 2026
Microsoft disclosed **CVE-2025-62221** and **CVE-2025-62454**, two elevation-of-privilege vulnerabilities in the **Windows Cloud Files Mini Filter Driver**, and released security updates to address them. The company identified **CVE-2025-62221** as an **Important** flaw caused by a **use-after-free** condition (`CWE-416`) that could allow a local attacker with low privileges to gain **SYSTEM** privileges without user interaction. Microsoft assigned **CVE-2025-62221** a **CVSS v3.1 score of 7.8** and said exploitation had been detected **in the wild** at the time of disclosure, although the vulnerability had not been publicly disclosed beforehand. Advisory listings for **CVE-2025-62454** also classify it as a Windows Cloud Files Mini Filter Driver elevation-of-privilege issue, indicating multiple privilege-escalation weaknesses in the same Windows component were addressed in the release.
Jun 29, 2026