# CVE-2026-83991 — Cloud Files Mini Filter Driver `cldflt.sys` Supersede Path Missing Leaf Access Check → Local Tampering

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver) |
| **CVE ID** | CVE-2026-83991 |
| **Impact** | Tampering (local — unauthorized modification of protected file state) |
| **MSRC severity** | Important |
| **CVSS** | 5.5 / 4.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C` |
| **CWE** | CWE-306: Missing Authentication for Critical Function |
| **Delivery** | Local — caller with base-directory create rights supersedes a protected leaf |
| **KB / Fixed build** | KB5124008 — `cldflt.sys` 10.0.26100.9444 (Win11 24H2/25H2 x64) |
| **Patch Date** | September 8, 2026 (2026-Sep) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.9278 — SHA256 `6084c66824fd2bc5fb0b1601affdd5e8119a5d76df181d0c12f97e2033ad8862` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.9444 — SHA256 `d108428a0541913751507f5f91da3f5837217f2cd65f6bebdcd52fcac6baf292` |
| **Feature flag** | `Feature_1245077819` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Public report: **`github.com/karollooool/CVE-2026-83991-writeup-and-poc`** demonstrates `GENERIC_WRITE`
> and `DeleteFileW` failing with `ERROR_ACCESS_DENIED` on a protected leaf while
> `CfCreatePlaceholders(SUPERSEDE)` returns `S_OK` and rewrites it as a cloud placeholder — under a single
> restricted, medium-integrity thread token. The diff pins the fix to a new `HsmpAccessCheck` in
> `HsmpOpCreatePlaceholders`, gated by `Feature_1245077819`.

---

## Product Description

`cldflt.sys` implements the Cloud Files placeholder mechanism behind the user-mode Cloud Filter API
(`CldApi.dll`). `CfCreatePlaceholders` — kernel handler `HsmpOpCreatePlaceholders` — creates placeholder
entries beneath a registered sync root; the per-entry flag `CF_PLACEHOLDER_CREATE_FLAG_SUPERSEDE` (`0x4`)
supplies overwrite semantics for an existing entry.

---

## Vulnerability Summary

Pre-patch, the **supersede** path accepted an ordinary existing leaf file and converted it into a cloud
placeholder based only on the caller's authority over the **base directory** — it never access-checked the
existing leaf's own DACL. A low-privileged caller with `FILE_ADD_FILE` on a directory (enough to register
a sync root and create children) but **denied write/delete** on a specific protected leaf could therefore
supersede that leaf: a read-only file (attributes `0x20`) becomes an `IO_REPARSE_TAG_CLOUD` placeholder
(`0x9000001A`, attributes `0x00401600`) while keeping the same NTFS file ID. That is unauthorized
modification of protected file state — a missing-authorization tampering bug (CWE-306). Microsoft rates it
**Important, 5.5** (`I:H`, no `C`/`A`).

---

## Prerequisites and Constraints

- Local, low-privileged (`AV:L`, `AC:L`, `PR:L`, `UI:N`).
- Caller has base-directory create rights but not write/delete on the target leaf.
- No memory corruption — the impact is integrity only (`C:N`/`I:H`/`A:N`): the leaf's *state*, not its
  arbitrary contents, is changed by the affected path.

---

## Vulnerability Details

### Root Cause

`CfCreatePlaceholders` documents that the caller needs `WRITE_DATA`/`WRITE_DAC` on the **base directory**.
The vulnerable supersede path treated that base-directory authority as sufficient for a state-changing
operation against a **pre-existing child**, contradicting normal file security where the child's own
security descriptor governs access (apart from `FILE_DELETE_CHILD`/inheritance).

### The patch (confirmed — diff, .9278 → .9444)

Gated behind `Feature_1245077819`, `HsmpOpCreatePlaceholders` now calls a **new `HsmpAccessCheck`** against
the existing leaf on the supersede path and refuses the conversion when the caller lacks the required
access to that leaf:

```c
// HsmpOpCreatePlaceholders (.9444) — PATCHED shape (Feature_1245077819)
if (existing_leaf && (flags & CF_PLACEHOLDER_CREATE_FLAG_SUPERSEDE)) {
    if (Feature_1245077819__IsEnabled()) {
        status = HsmpAccessCheck(/* existing leaf, required access */);   // *** NEW ***
        if (!NT_SUCCESS(status))
            return status;      // parent-directory rights no longer authorize the supersede
    }
}
```

`HsmpAccessCheck` is new in `.9444`. With it, permission to create beneath a directory no longer reaches a
path that transforms a stricter child already inside it.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1245077819`.** The new leaf check runs only when the flag is enabled; the
original unchecked supersede path ships when disabled. Verify the flag is enabled to confirm the fix is
live. The public PoC's `CONFIRMED` condition should no longer be reachable on a fixed, flag-enabled build.

---

## Detection Guidance

**Behavioural.** Processes registering a sync root over a directory they only have create rights to, then
calling `CfCreatePlaceholders` with `SUPERSEDE` against a pre-existing non-placeholder file; files gaining
`IO_REPARSE_TAG_CLOUD` while their pre-conversion DACL denied the caller write/delete.

**Config.** The fix is CFR-gated — confirm `Feature_1245077819` is enabled and the Sep-2026 update
(`cldflt.sys` 10.0.26100.9444, KB5124008) is installed.

---

## References

- MSRC advisory — CVE-2026-83991 (Windows Cloud Files Mini Filter Driver Tampering), 2026-09-08, KB5124008.
- Public writeup + PoC — `github.com/karollooool/CVE-2026-83991-writeup-and-poc`.
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2026-83991-ghidriff.md`