CVE-2026-80093: Windows 10 1809 Use-After-Free Vulnerability

CVE-2026-80093 Overview

CVE-2026-80093 is a use-after-free vulnerability [CWE-416] in the Windows Cloud Files Mini Filter Driver (cldflt.sys). An authorized local attacker can exploit the flaw to elevate privileges on affected Windows systems. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases. Microsoft addressed the issue through its Security Update Guide.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the local system, enabling full compromise of confidentiality, integrity, and availability from a low-privileged user context.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-80093 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80093

Vulnerability Analysis

The flaw resides in the Windows Cloud Files Mini Filter Driver, a kernel-mode filesystem filter that supports cloud-synced placeholder files used by services such as OneDrive. The driver mismanages the lifetime of an internal object, allowing code to reference memory after it has been freed. An attacker who can invoke the driver from a local, low-privileged context can trigger the dangling reference and manipulate freed kernel memory. Successful exploitation yields kernel-level code execution, which translates directly to local privilege elevation.

Root Cause

The root cause is a use-after-free condition [CWE-416] in cldflt.sys. The driver releases a kernel object while another code path retains a pointer to it. Subsequent access to the stale pointer dereferences attacker-controllable memory. The condition is timing-sensitive, which is reflected in the high attack complexity rating.

Attack Vector

Exploitation requires local access and low privileges on the target host. An attacker executes code as a standard user and issues crafted requests to the Cloud Files filter driver, racing operations to reach the vulnerable state. Because the driver runs in kernel mode, any successful memory corruption bypasses user-mode security boundaries and elevates the attacker to SYSTEM. No user interaction is required.

No verified public proof-of-concept is available. Refer to the Talos Intelligence Vulnerability Report (TALOS-2026-2445) for additional technical detail.

Detection Methods for CVE-2026-80093

Indicators of Compromise

Unexpected kernel bugchecks referencing cldflt.sys or Cloud Files Mini Filter operations, particularly on hosts without OneDrive activity by the associated user.
New processes running as NT AUTHORITY\SYSTEM that were spawned from a standard user session shortly after cloud files API activity.
Loading of unsigned or unusual helper binaries by low-privileged users prior to a privilege transition.

Detection Strategies

Hunt for token-elevation events (Windows Event ID 4672) that follow interactive logons by non-administrative accounts.
Correlate crashes or filter-driver errors from cldflt.sys with recent process creation from user-writable directories.
Apply behavioral rules that flag standard users invoking cloud placeholder APIs at abnormal rates, indicative of a race-condition exploit attempt.

Monitoring Recommendations

Ingest Windows kernel and filter-manager telemetry into a centralized SIEM to enable cross-host correlation of cldflt.sys anomalies.
Enable and forward Sysmon Event IDs 1 (process create) and 10 (process access) to identify parent-child chains that culminate in SYSTEM-level execution.
Monitor endpoint patch state against Microsoft's August/September 2026 update baseline to identify unpatched hosts exposed to CVE-2026-80093.

How to Mitigate CVE-2026-80093

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-80093 across all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching on multi-user hosts, jump servers, and virtual desktop infrastructure where local attackers are most likely to gain a foothold.
Audit local account membership and remove unnecessary interactive logon rights for standard users on sensitive systems.

Patch Information

Microsoft has issued fixes through the Security Update Guide. Administrators should deploy the cumulative update covering cldflt.sys to every supported Windows 10 build (1809, 21H2, 22H2), Windows 11 build (23H2, 24H2, 25H2, 26H1), and Windows Server release (2019, 2022, 2025). Validate patch installation by confirming updated file versions of cldflt.sys after reboot.

Workarounds

Where patching must be delayed, restrict local logon rights and remove standard users from hosts that do not require interactive access.
Disable the Cloud Files (Windows Cloud Files) feature on systems that do not rely on OneDrive or third-party cloud sync clients, reducing the driver's attack surface.
Enforce application control policies (for example, Windows Defender Application Control) to block execution of unauthorized binaries used to trigger the vulnerability.

bash

# Verify installed cldflt.sys version after patching (PowerShell)
Get-Item C:\Windows\System32\drivers\cldflt.sys | Select-Object VersionInfo