CVE-2026-34337: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-34337 Overview

CVE-2026-34337 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw allows an authorized local attacker to elevate privileges on affected Windows client and server systems. Microsoft classifies the issue under CWE-362, indicating a concurrent execution race condition that leads to the unsafe reuse of freed kernel memory. Successful exploitation enables an attacker with low privileges to gain SYSTEM-level access, compromising confidentiality, integrity, and availability of the host. The vulnerability affects supported Windows 10, Windows 11, and Windows Server releases.

Critical Impact
A local authenticated attacker can leverage a kernel use-after-free in the Cloud Files Mini Filter Driver to escalate to SYSTEM, gaining full control of the affected Windows host.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-05-12 - CVE-2026-34337 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-34337

Vulnerability Analysis

The Cloud Files Mini Filter Driver (cldflt.sys) implements the kernel-side logic for the Windows Cloud Files API, used by sync engines such as OneDrive to expose placeholder files to user applications. The driver manages reparse points, callback contexts, and per-file state objects that are referenced by both user-mode and kernel-mode components. A use-after-free condition arises when one execution path frees an object while another path still holds a reference to it. When the stale pointer is later dereferenced, the driver operates on memory that may have been reallocated, enabling kernel-mode memory corruption.

Root Cause

The root cause is a race condition [CWE-362] in the object lifetime management of cldflt.sys. Concurrent I/O operations targeting cloud placeholder files allow one thread to release a kernel object while another thread continues to access it. Insufficient synchronization between reference counting and teardown enables the use-after-free. The high attack complexity reflects the need for precise timing to win the race.

Attack Vector

Exploitation requires local code execution with low privileges. An attacker triggers concurrent operations against Cloud Files-managed objects, such as filter callback contexts or placeholder file handles, to provoke the race. After freeing the target object, the attacker grooms the kernel pool to reclaim the slot with attacker-controlled data. When the driver dereferences the stale pointer, the attacker can corrupt kernel structures and pivot to arbitrary kernel read/write or direct token replacement to elevate to SYSTEM.

No public proof-of-concept exploit is associated with this CVE at publication. Refer to the Microsoft Security Update Guide for CVE-2026-34337 for vendor details.

Detection Methods for CVE-2026-34337

Indicators of Compromise

Unexpected bug checks referencing cldflt.sys (for example, DRIVER_VERIFIER_DETECTED_VIOLATION or KERNEL_MODE_HEAP_CORRUPTION) on systems running OneDrive or other Cloud Files sync clients.
Low-privileged processes spawning SYSTEM-level child processes shortly after heavy I/O against cloud placeholder files.
Anomalous handle activity from non-sync-engine processes against files marked with Cloud Files reparse points.

Detection Strategies

Monitor for token manipulation patterns where a non-elevated process suddenly executes with NT AUTHORITY\SYSTEM privileges without a legitimate elevation event (Event ID 4672 from an unexpected source).
Alert on kernel crash dumps that fault inside cldflt.sys or related filter manager routines, which can indicate failed exploitation attempts.
Hunt for processes that rapidly open, modify, and delete files with Cloud Files reparse points to trigger the race window.

Monitoring Recommendations

Enable Driver Verifier on test systems against cldflt.sys to surface unsafe memory access during validation.
Centralize Windows kernel error reports and Sysmon Event ID 11/23 (file create/delete) telemetry to identify suspicious bursts of placeholder file operations.
Track installation status of the May 2026 Microsoft security update across the fleet using configuration management tooling.

How to Mitigate CVE-2026-34337

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-34337 to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching on multi-user systems, terminal servers, and developer workstations where local code execution by lower-privileged users is more likely.
Audit local user accounts and remove unnecessary interactive logon rights to reduce the attacker pool.

Patch Information

Microsoft addressed CVE-2026-34337 in the May 2026 security update cycle. Patches are available through Windows Update, WSUS, and the Microsoft Update Catalog. Consult the Microsoft Security Update Guide for the specific KB articles corresponding to each affected Windows build.

Workarounds

If patching must be delayed, disable the Cloud Files filter where OneDrive or other sync engines are not required by stopping and disabling the CldFlt service.
Restrict local logon to trusted administrators on systems that cannot be patched immediately.
Apply application allowlisting (for example, Windows Defender Application Control) to block unauthorized binaries that could be used to trigger the race.

bash

# Configuration example: query and disable the Cloud Files mini filter on unpatched hosts
sc.exe query CldFlt
sc.exe config CldFlt start= disabled
# Reboot required for the change to take effect