CVE-2026-33835: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-33835 Overview

CVE-2026-33835 is a use-after-free vulnerability [CWE-416] in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw allows a locally authenticated attacker to elevate privileges on affected Windows systems. Microsoft assigned the issue a CVSS 3.1 base score of 7.8 and identifies it as an Elevation of Privilege class vulnerability.

The Cloud Files Mini Filter Driver underpins the Cloud Files API used by OneDrive and other cloud sync providers. Because the driver runs in kernel mode, successful exploitation enables an attacker to execute code at SYSTEM. The vulnerability affects supported builds of Windows 10, Windows 11, and Windows Server.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on the local host, breaking the user-to-kernel security boundary and enabling full host compromise.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-05-12 - CVE-2026-33835 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-33835

Vulnerability Analysis

The vulnerability resides in the Windows Cloud Files Mini Filter Driver, which mediates I/O between user-mode cloud sync engines and the NTFS file system. A use-after-free condition occurs when the driver references a kernel object after it has been freed. An attacker who can issue crafted I/O requests to the driver can reclaim the freed allocation with controlled data.

Because the driver operates in kernel mode, a successful reclaim of the freed object lets the attacker influence kernel control flow. This typically results in arbitrary kernel-mode read, write, or execution. The end outcome is escalation from a standard user context to SYSTEM.

Exploitation requires local access and low-privilege authenticated execution on the target. No user interaction is needed beyond running the exploit binary. The attacker must already have code execution on the host, so this CVE is most relevant as a post-compromise privilege escalation primitive.

Root Cause

The root cause is improper lifetime management of a kernel object inside cldflt.sys. A reference to the object persists after the object has been freed, creating a window where the freed allocation can be replaced with attacker-controlled data before the dangling pointer is dereferenced.

Attack Vector

The attack vector is local. An authenticated user invokes specific Cloud Files driver IOCTLs or file system operations against placeholder files to trigger the freed-object reuse. Microsoft has not published exploitation details, and no public proof-of-concept is currently available. The EPSS forecast reflects low near-term exploitation likelihood, but kernel-mode use-after-free issues are historically attractive targets for local privilege escalation chains.

No verified exploitation code is publicly available for this vulnerability. Refer to the Microsoft Security Update Guide CVE-2026-33835 for vendor-supplied technical context.

Detection Methods for CVE-2026-33835

Indicators of Compromise

Unexpected SYSTEM-level processes spawned from a standard user session shortly after Cloud Files driver activity.
Kernel bug checks referencing cldflt.sys (bug check codes such as 0x3B SYSTEM_SERVICE_EXCEPTION or 0x50 PAGE_FAULT_IN_NONPAGED_AREA) on hosts where exploitation is attempted but fails.
New or modified placeholder files and reparse points created immediately before privilege transitions.

Detection Strategies

Monitor for token manipulation and process integrity-level escalation from medium to system on endpoints.
Alert on unsigned or unusual binaries opening handles to \\.\CldFlt or issuing Cloud Files filter IOCTLs.
Correlate kernel crashes in cldflt.sys with subsequent privilege escalation or persistence events on the same host.

Monitoring Recommendations

Enable Windows Defender Application Control or attack surface reduction rules that block untrusted binaries from interacting with kernel drivers.
Forward Sysmon and Windows event logs to a centralized analytics platform and retain kernel crash dumps for forensic review.
Baseline normal Cloud Files driver behavior so anomalous IOCTL volumes or sequences are surfaced.

How to Mitigate CVE-2026-33835

Immediate Actions Required

Apply the May 2026 Microsoft security updates referenced in the MSRC advisory to all affected Windows 10, Windows 11, and Windows Server builds.
Inventory hosts running the Cloud Files Mini Filter Driver and prioritize patching of multi-user systems, jump hosts, and developer workstations.
Restrict local logon rights and remove unnecessary interactive users on servers to reduce the population of accounts able to trigger the bug.

Patch Information

Microsoft has released cumulative updates that address CVE-2026-33835. Patch identifiers and download links for each supported Windows version are published in the Microsoft Security Update Guide CVE-2026-33835. Administrators should deploy the updates through Windows Update, WSUS, Microsoft Intune, or Configuration Manager according to standard change control.

Workarounds

No official workaround replaces patching. Where patching must be delayed, limit local access to affected hosts and enforce least-privilege policies.
Disable OneDrive and third-party cloud sync clients that load the Cloud Files filter on systems where they are not required.
Use application control policies to prevent execution of untrusted user-mode binaries that could deliver an exploit.

bash

# Verify the Cloud Files Mini Filter Driver version on a Windows host
Get-Item C:\Windows\System32\drivers\cldflt.sys | Select-Object VersionInfo

# List loaded minifilters and confirm cldflt is present
fltmc filters