CVE-2026-80093

CVE-2026-80093 is a use-after-free memory-safety flaw (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), the in-box kernel filesystem filter that backs cloud placeholder files via the Cloud Files API. An attacker who already holds valid low-privilege credentials on a host triggers the flaw through specific operations against cloud-files placeholders, causing the driver to reference freed kernel memory; the High attack-complexity rating indicates the required conditions do not line up trivially. A successful exploit elevates the attacker's privileges locally, granting full control of the affected machine with high impact to confidentiality, integrity, and availability — the flaw is not remotely exploitable on its own. Virtually every maintained Windows 10/11 and Windows Server deployment ships this driver, so any Windows host where untrusted users can run code is plausibly affected; the available data does not list specific affected builds, and fixes shipped in Microsoft's September 2026 Patch Tuesday. As of the data available there is no public PoC, the CVE is not in CISA KEV, and EPSS is low (0.3%, 28th percentile), indicating no confirmed exploitation in the wild; while the September 2026 release included two zero-days, whether this CVE is among them is not confirmed here.

What to do: Apply Microsoft's September 2026 Windows cumulative security updates to all Windows 10/11 clients and Windows Servers, prioritizing multi-user hosts such as RDS/VDI servers, terminal servers, and shared workstations where local logon is common. Because exploitation requires valid local credentials, an interim mitigation is to restrict interactive logon, RDP, and local account creation to trusted users on unpatched hosts. After patching, verify on critical systems that the updated cldflt.sys file version from the September 2026 update is in place.