CVE-2026-27926 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Executive Summary
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 1809 for 32-bit Systems | 5082123 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for x64-based Systems | 5082123 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for 32-bit Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5082200 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 23H2 for ARM64-based Systems | 5082052 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 23H2 for x64-based Systems | 5082052 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5083769 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5083769 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5083769 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5083769 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5083768 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5083768 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 | 5082123 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 (Server Core installation) | 5082123 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 | 5082142 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 (Server Core installation) | 5082142 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022, 23H2 Edition (Server Core installation) | 5082060 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5082063 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5082063 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5082123 |
Security Update | Yes |
5082200 |
Security Update | Yes |
5082052 |
Security Update | Yes |
5083769 |
Security Update | Yes |
5083768 |
Security Update | Yes |
5082142 |
Security Update | Yes |
5082060 |
Security Update | Yes |
5082063 |
Security Update | Yes |
Patch Diff
Race condition (CWE-362) leading to use-after-free (CWE-416) in the Windows Cloud Files minifilter cldflt.sys sync-root lifecycle, local EoP to SYSTEM (AC:H race). cldflt.sys (Cloud Files / OneDrive on-demand) tracks per-volume 'sync root' objects in a Unicode prefix table; CldSyncGetRootInfo / HsmiCldGetSyncRootInfoByFileObject look a sync root up and read its info while CldSyncCleanup / CldiPortNotifyDisconnect remove/free it. PRE: sync-root lookup/info-read was not synchronized against cleanup, so a concurrent CldSyncCleanup could remove the root from the prefix table and free it while another thread was still using it - a race yielding a use-after-free of the sync-root object. Because cldflt runs in the kernel and the sync operations are reachable by a local user, winning the race (AC:H) is a local EoP-to-SYSTEM primitive. Diff of cldflt.sys 10.0.26100.8115 -> .8246 (Apr 14 2026, KB5083769) confirms the fix: gated behind CFR flag Feature_1074201912, CldSyncCleanup now acquires an Flt push lock (FltAcquirePushLockExclusiveEx) around the prefix-table removal (RtlRemoveUnicodePrefix), and CldSyncGetRootInfo takes rundown protection and a reference on the root (CldiSyncReferenceRoot / ExReleaseRundownProtection on root+0x58) before using it - so the root cannot be freed while in use, closing the race/UAF.
| Function | Address | Change | Note |
|---|---|---|---|
CldSyncCleanup |
code change |
code (prefix-table removal under push lock, CFR-gated) | Post (Feature_1074201912): FltAcquirePushLockExclusiveEx(&lock) around RtlRemoveUnicodePrefix(root prefix) / RtlNextUnicodePrefix, then FltReleasePushLockEx - serializing sync-root removal against lookups. |
CldSyncGetRootInfo |
code change |
code (reference + rundown protection before use) | Post: CldiSyncReferenceRoot(root) + rundown protection (ExReleaseRundownProtection on root+0x58) taken before reading root info, so the root can't be freed mid-use. |
HsmiCldGetSyncRootInfoByFileObject / CldSyncConnectRoot / CldiPortNotifyDisconnect / CldSyncGetSyncProviderProcessId |
code change |
code (sync-root access serialized) | Related sync-root lookup/connect/disconnect paths updated under the same gate to use the lock/reference discipline. |
Feature_1074201912 |
gate |
added (CFR gate) | CFR flag gating the push-lock + rundown-reference synchronization; the original unsynchronized path still ships when disabled. |
Attack Path
A Cloud Files sync root is cleaned up/freed while another thread reads its info, causing a UAF
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.