CVE-2023-36036: Windows 10 Privilege Escalation Flaw

CVE-2023-36036 Overview

CVE-2023-36036 is an Elevation of Privilege vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). This kernel-mode driver is responsible for handling cloud file synchronization operations in Windows, including integration with OneDrive and other cloud storage providers. A successful exploit allows a local attacker with low privileges to escalate their permissions to SYSTEM level, gaining complete control over the affected Windows host.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage this flaw to achieve full system compromise from a low-privileged local account.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022

Discovery Timeline

• November 14, 2023 - CVE-2023-36036 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36036

Vulnerability Analysis

The Windows Cloud Files Mini Filter Driver vulnerability stems from improper memory handling within kernel-mode operations. The associated CWE classifications—CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write)—indicate that the driver fails to properly validate buffer boundaries when processing cloud file operations.

When the cldflt.sys driver handles certain file operations, it does not adequately verify the size or structure of user-supplied data before writing to kernel memory. This allows an attacker to craft malicious input that corrupts adjacent heap memory or writes data beyond allocated buffer boundaries. Because this occurs in kernel space, successful exploitation results in code execution with the highest system privileges.

Root Cause

The root cause is a heap-based buffer overflow (CWE-122) combined with out-of-bounds write conditions (CWE-787) in the Windows Cloud Files Mini Filter Driver. The driver fails to properly validate the length and content of data passed from user-mode applications during cloud file synchronization operations. This insufficient input validation allows attackers to manipulate kernel heap memory structures, potentially overwriting critical kernel objects or function pointers.

Attack Vector

The attack requires local access to the target system with at least low-level user privileges. An attacker must execute a specially crafted application or trigger specific cloud file operations that invoke the vulnerable code path in cldflt.sys. No user interaction is required beyond the initial execution of the malicious payload.

The attack flow typically involves:

1. The attacker gains initial access to a Windows system with a low-privileged account
2. A malicious application is executed that interacts with the Cloud Files Mini Filter Driver
3. Crafted data triggers the heap overflow condition in kernel memory
4. The attacker overwrites kernel structures to redirect execution flow
5. Arbitrary code executes with SYSTEM privileges, completing the privilege escalation

Since no public proof-of-concept code is currently available, specific exploitation techniques remain undisclosed. However, the confirmed in-the-wild exploitation indicates that threat actors have developed reliable exploit chains for this vulnerability.

Detection Methods for CVE-2023-36036

Indicators of Compromise

• Unusual process creation events where low-privileged processes spawn SYSTEM-level child processes
• Suspicious activity involving cldflt.sys driver interactions, including unexpected IOCTL calls
• Memory access violations or kernel crash dumps referencing the Cloud Files Mini Filter Driver
• Anomalous cloud file synchronization activity from processes not associated with legitimate cloud storage applications

Detection Strategies

• Enable Windows Kernel Audit logging to capture driver load events and kernel object access patterns
• Deploy endpoint detection rules that monitor for privilege escalation sequences following cloud file operations
• Implement behavioral analytics to detect processes that unexpectedly gain elevated privileges
• Monitor for suspicious process hollowing or injection techniques that may be used in conjunction with this exploit

Monitoring Recommendations

• Configure Security Event Log monitoring for Event IDs 4688 (Process Creation) with command line auditing enabled
• Deploy Sysmon with rules targeting driver load events (Event ID 6) and process access patterns (Event ID 10)
• Implement kernel integrity monitoring to detect unauthorized modifications to kernel memory
• Establish baseline behavior for cloud file synchronization processes to identify anomalous activity

How to Mitigate CVE-2023-36036

Immediate Actions Required

• Apply Microsoft's November 2023 security updates immediately across all affected Windows systems
• Prioritize patching for systems in the CISA KEV catalog deadline compliance window
• Review systems for signs of compromise before and after patching, given confirmed in-the-wild exploitation
• Implement network segmentation to limit lateral movement opportunities for attackers who may have already exploited this vulnerability

Patch Information

Microsoft released security updates addressing CVE-2023-36036 as part of the November 2023 Patch Tuesday release. Organizations should obtain patches from the Microsoft Security Update Guide and deploy them according to their patch management policies. Given the confirmed exploitation in the wild and CISA KEV listing, this vulnerability should be treated as an emergency patching priority.

Patches are available for all supported Windows versions, including:

• Windows 10 versions 1507, 1607, 1809, 21H2, and 22H2
• Windows 11 versions 21H2, 22H2, and 23H2
• Windows Server 2008 SP2 through Windows Server 2022

Workarounds

• Restrict local user account privileges and implement the principle of least privilege across the environment
• Consider disabling or restricting cloud file synchronization features on high-security systems where they are not required
• Deploy application control policies to prevent unauthorized executables from running on critical systems
• Enhance monitoring and alerting for privilege escalation attempts while patches are being deployed

# Verify Cloud Files Mini Filter Driver status and patch level
sc query cldflt
wmic qfe list brief | findstr /i "KB5032189 KB5032190 KB5032192"