# Root Cause Analysis — CVE-2026-58613
## Summary
| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-58613 |
| **Binary** | cldflt.sys (Cloud Files Mini Filter Driver) |
| **Vulnerability** | Use-After-Free in `CldiStreamCompleteRequest` |
| **Impact** | Elevation of Privilege (kernel code execution) |
| **CVSS 3.1** | 8.8 — AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| **CWE** | CWE-416: Use After Free |
| **Pre-patch version** | 10.0.26100.8737 (KB5095093, June 2026) |
| **Post-patch version** | 10.0.26100.8875 (KB5101650, July 2026) |
| **Patch Tuesday** | July 14, 2026 |
---
## Component Overview
The Cloud Files Mini-Filter Driver (`cldflt.sys`) is a Windows kernel-mode
filesystem minifilter that enables cloud storage integration (OneDrive Files
On-Demand, Dropbox Smart Sync, etc.). It manages placeholder files,
transparent hydration, and progress reporting between cloud sync providers and
the Windows Shell.
The driver maintains a **global countdown timer list** — a kernel linked list
of pending blocking requests sent to cloud sync providers. Each entry carries
a 60-second deadline. When the deadline fires, a worker thread walks the list
and cancels all expired requests.
---
## Ghidra-Verified Call Chain (pre-patch cldflt.sys 10.0.26100.8737)
### Step 1 — Setup: inserting a request onto the global timer list
A cloud sync provider calls `CfReportProviderProgress2` with
`progressCompleted < progressTotal` (e.g. completed=297, total=1000).
```
User-mode:
CfReportProviderProgress2(connKey, transferKey, reqKey,
total=1000, completed=297, sessionId=0)
→ cldapi!CfReportProviderProgress2
→ FilterSendMessage
Kernel (cldflt.sys):
CldiPortNotifyMessage @ 0x14004a270
→ CldiPortProcessTransfer @ 0x14004c950
→ CldiPortProcessReportProgress @ 0x140049110
→ CldSyncReportProgress @ 0x14004a09c
→ CldStreamReportProgress @ 0x140049e38
→ CldiStreamBuildProviderRequest @ 0x1400407b4
→ CldiStreamInsertIntoGlobalRequestListNoLock
@ 0x14000cf94
```
The request now sits on the global timer list with a 60-second deadline.
The request structure holds `pRequest->pStreamHandleCtx->pStreamCtx` — a
pointer to the `HSM_STREAM_CONTEXT` whose FltMgr refcount is >1.
### Step 2 — Orphaning the request
The provider process terminates **without** calling `CfDisconnectSyncRoot` or
`CfUnregisterSyncRoot`. The request survives on the global timer list because
process-exit cleanup does not drain provider-initiated progress requests.
If `CfUnregisterSyncRoot` were called, it would walk the list and complete
requests with `STATUS_CLOUD_FILE_PROVIDER_TERMINATED` (0xC000CF16). Process
termination bypasses this path entirely.
### Step 3 — Eroding the stream context refcount
Deleting files and directories under the sync root (`rmdir /s /q`) causes
NTFS file-close operations. Each close traverses the FltMgr cleanup path,
calling `FltReleaseContext` on cached stream context references. This erodes
the `HSM_STREAM_CONTEXT` refcount until the orphaned timer-list request holds
the **sole remaining reference** (refcount == 1).
### Step 4 — Triggering the timer walk
~60 seconds after Step 1, the request's deadline expires. We trigger the
timer walk immediately by calling the undocumented `CfQueryProgress` API,
which sends port command `0x4001` to `\CLDMSGPORT`:
```
User-mode:
CfQueryProgress(transferKey, ...)
→ cldapi!CfQueryProgress
→ FilterSendMessage (port cmd 0x4001)
Kernel (cldflt.sys):
CldiPortNotifyMessage @ 0x14004a270
→ CldiPortProcessFilterControl @ 0x14007b14c
→ CldiPortProcessQueryProgress @ 0x14007b1e8
→ CldStreamQueryProgress @ 0x14007b514
→ CldiStreamRestartCountdownTimer @ 0x140037688
→ CldiStreamStartCountdownTimer @ 0x140034d70
```
`CldiStreamStartCountdownTimer` walks the global list and cancels all expired
requests. Our request has `MasterRequest == NULL` (it was provider-initiated,
no user I/O request), so it takes the `CldiStreamCancelSynchronousRequest`
path:
```
→ CldiStreamCancelSynchronousRequest
@ 0x1400409f8
→ CldiStreamCompleteCanceledRequest
@ 0x140040c58
→ CldiStreamCompleteRequest @ 0x1400841bc ← UAF
```
### Step 5 — The UAF in CldiStreamCompleteRequest
**Pre-patch decompilation** (Ghidra, cldflt.sys 10.0.26100.8737 @ 0x1400841bc):
```c
void CldiStreamCompleteRequest(
longlong *pStreamHandleCtx, // param_1
uint *pRequest, // param_2
ulonglong completionStatus, // param_3
uint cancelFlags) // param_4
{
// ... WPP tracing, request-list manipulation omitted ...
uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline();
if ((int)uVar5 == 0) {
// OLD PATH — correct order:
if (*(char *)((longlong)pRequest + 0x69) == '\0') {
CldiStreamCdqRELEASE(
*(longlong *)(*pStreamHandleCtx + 8) + 0x90); // RELEASE first
}
CldiStreamDeleteRequest(pRequest); // then DELETE
}
else {
// NEW PATH (Feature_2089223483 enabled) — VULNERABLE:
CldiStreamDeleteRequest(pRequest); // DELETE first ← FREE
CldiStreamCdqRELEASE(
*(longlong *)(*pStreamHandleCtx + 8) + 0x90); // ← UAF!
}
// ...
}
```
**Feature_2089223483** (symbolic name: `Feature_H2E_WPA3SAE`) gates the new
code path introduced in the May 2026 update. When enabled, the call order is
**inverted**: `CldiStreamDeleteRequest` runs first, which calls
`FltReleaseContext` on the stream context. Since the orphaned request holds
the **last reference**, the refcount drops to zero and FltMgr synchronously
frees the pool block:
```
CldiStreamDeleteRequest+0xC5: FltReleaseContext(pStreamCtx)
→ FltMgr: refcount → 0, invoke cleanup callback
→ HsmFltDeleteSTREAM_CONTEXT
→ CldHsmDeleteStreamContext
→ CldStreamClose: ExFreePoolWithTag(pCldStream, 'Clst') ← FREED
```
When execution returns to `CldiStreamCompleteRequest`, the next line
dereferences `*pStreamHandleCtx` — which points into the just-freed pool
block. This is the use-after-free.
---
## Root Cause
A **feature-flag-gated code path** introduced in the May 2026 update inverted
the deletion order in `CldiStreamCompleteRequest`. The old code correctly
released the CDQ lock before deleting the request (ensuring the stream context
refcount was still positive during the release). The new code deletes the
request first — dropping the last stream context reference and freeing the
pool — then dereferences the freed pointer.
The UAF is only reachable when all of these conditions are met:
1. `Feature_2089223483` is enabled (May 2026+ builds)
2. A provider-initiated progress request is on the global timer list
(`MasterRequest == NULL`)
3. The provider process exits without calling `CfUnregisterSyncRoot`
(orphaning the request)
4. All other stream context references are released (refcount == 1)
5. The request's 60-second deadline expires and the timer walk fires
---
## Exploitation Potential
The freed pool block is from a paged pool with tag `Clst`. The 60-second
window between insertion and expiry gives an attacker ample time to:
1. Spray controlled allocations into the freed pool slot
2. Craft a fake `HSM_STREAM_CONTEXT` whose first QWORD points to
attacker-controlled data
3. When `CldiStreamCdqRELEASE` dereferences the fake pointer, it calls
through a function pointer that can be redirected to arbitrary code
Combined with the fact that `CldiStreamCompleteRequest` runs at `PASSIVE_LEVEL`
in the context of the calling process, this provides a reliable kernel EoP
primitive.
---
## Fix (July 2026, KB5101650)
The July 2026 patch corrects the deletion order under the feature flag:
the CDQ release now runs **before** `CldiStreamDeleteRequest`, matching the
old code path's behavior. Additionally, a reference hold is added in
`CldiStreamCompleteCanceledRequest` (visible in the pre-patch decompilation:
`CldiStreamCdqACQUIRE` is called when `Feature_2089223483` is enabled) to
ensure the stream context survives through the completion sequence.
---
## References
- [TALOS-2026-2426](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2426)
- [MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613)
- [Microsoft July 2026 Patch Tuesday](https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul)
---
---
## Detection Rules
### YARA — Vulnerable cldflt.sys (pre-patch binary identification)
```yara
rule CVE_2026_58613_Vulnerable_cldflt
{
meta:
description = "Detects pre-patch cldflt.sys vulnerable to CVE-2026-58613 UAF"
cve = "CVE-2026-58613"
author = "OnlyFm252 Blue Team"
date = "2026-07-17"
reference = "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2426"
strings:
// Feature_2089223483 — the feature flag that gates the vulnerable code path.
// Present in May and June 2026 builds; removed/refactored in July 2026 fix.
$feature_flag = "Feature_2089223483" ascii wide
// CldiStreamCompleteRequest — the function containing the UAF
$vuln_func = "CldiStreamCompleteRequest" ascii wide
// CldiStreamDeleteRequest called before CldiStreamCdqRELEASE
// (vulnerable ordering). Look for the call sequence in .text:
// E8 xx xx xx xx call CldiStreamDeleteRequest
// 48 8B xx mov rax/rcx, [reg] (load from freed ptr)
// This pattern matches the inverted call order in the else branch.
// Driver description string
$desc = "Cloud Files Mini Filter Driver" ascii wide
// PE version range: 10.0.26100.8400 - 10.0.26100.8799
// (covers May and June 2026 builds with the bug)
$ver_prefix = "10.0.26100.8" ascii wide
condition:
uint16(0) == 0x5A4D and
$desc and
$feature_flag and
$vuln_func and
$ver_prefix
}
```
### YARA — PoC / exploit artifact detection
```yara
rule CVE_2026_58613_Exploit_Artifact
{
meta:
description = "Detects exploit or PoC artifacts targeting CVE-2026-58613"
cve = "CVE-2026-58613"
author = "OnlyFm252 Blue Team"
date = "2026-07-17"
strings:
// Cloud Filter API imports used in the attack sequence
$api1 = "CfRegisterSyncRoot" ascii wide
$api2 = "CfConnectSyncRoot" ascii wide
$api3 = "CfReportProviderProgress" ascii wide
$api4 = "CfQueryProgress" ascii wide
$api5 = "CfCreatePlaceholders" ascii wide
// Suspicious: connecting + reporting progress + NOT disconnecting
// (normal apps always call CfDisconnectSyncRoot)
$disconnect = "CfDisconnectSyncRoot" ascii wide
$unregister = "CfUnregisterSyncRoot" ascii wide
// Common PoC strings
$poc1 = "CVE-2026-58613" ascii wide nocase
$poc2 = "CldiStreamCompleteRequest" ascii wide
$poc3 = "orphan" ascii wide nocase
$poc4 = "timer" ascii wide nocase
// cldapi.dll import
$cldapi = "cldapi.dll" ascii wide nocase
condition:
uint16(0) == 0x5A4D and
$cldapi and
$api1 and $api2 and $api3 and
(
// Has CfReportProviderProgress but NOT CfDisconnectSyncRoot
// (abnormal — legitimate providers always disconnect)
($api3 and not $disconnect) or
// Or explicit PoC/exploit references
any of ($poc*)
)
}
```
### Sigma — Suspicious Cloud Filter API usage pattern
```yaml
title: CVE-2026-58613 Suspicious Cloud Filter Provider Behavior
id: a3e7f912-5d8c-4b1a-9e3f-2c8d6a4f1b07
status: experimental
description: |
Detects the exploitation pattern for CVE-2026-58613: a process that
loads cldapi.dll (Cloud Filter API), creates a sync root, then
terminates abnormally without disconnecting. The orphaned timer-list
request leads to a UAF in cldflt.sys.
references:
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2426
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613
author: OnlyFm252 Blue Team
date: 2026-07-17
tags:
- attack.privilege_escalation
- attack.t1068
- cve.2026.58613
logsource:
category: image_load
product: windows
detection:
selection_cldapi:
ImageLoaded|endswith: '\cldapi.dll'
filter_known_providers:
Image|endswith:
- '\OneDrive.exe'
- '\OneDriveStandaloneUpdater.exe'
- '\FileCoAuth.exe'
- '\Dropbox.exe'
- '\DropboxUpdate.exe'
- '\GoogleDriveFS.exe'
- '\iCloudDrive.exe'
- '\explorer.exe'
- '\SearchProtocolHost.exe'
condition: selection_cldapi and not filter_known_providers
falsepositives:
- Third-party cloud sync providers not in the allowlist
- Development/testing of cloud filter applications
level: medium
---
title: CVE-2026-58613 Process Exit Without Cloud Filter Disconnect
id: b4f8c023-6e9d-4c2a-af40-3d9e7b5f2c18
status: experimental
description: |
Detects a process that loaded cldapi.dll terminating unexpectedly.
The CVE-2026-58613 exploit requires the provider to exit without
calling CfDisconnectSyncRoot, orphaning a timer-list request.
references:
- https://talosintelligence.com/vulnerability_reports/TALOS-2026-2426
author: OnlyFm252 Blue Team
date: 2026-07-17
tags:
- attack.privilege_escalation
- attack.t1068
- cve.2026.58613
logsource:
category: process_termination
product: windows
detection:
selection:
Image|endswith:
- '.exe'
filter_known:
Image|endswith:
- '\OneDrive.exe'
- '\explorer.exe'
- '\Dropbox.exe'
condition: selection and not filter_known
falsepositives:
- Application crashes unrelated to exploitation
level: low
```
### Sysmon — Configuration rules
```xml
cldapi.dllOneDriveDropboxGoogleDriveFSexplorer.exeSearchProtocolHostCfReportProviderProgresscve_2026_58613CVE-2026-58613--childpoc_cve_2026_58613\AppData\Local\Temp\_test\AppData\Local\Temp\OneDriveDropbox
```
### WDAC (Windows Defender Application Control) — Deny policy
```xml
10.0.1.0{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}
```
---
*Analysis performed on pre-patch cldflt.sys 10.0.26100.8737 (KB5095093)
using Ghidra with PDB symbols.*