Microsoft Windows Cloud Minifilter Flaw Enables Privilege Escalation

A critical security vulnerability in Microsoft Windows Cloud Minifilter has been patched, addressing a race condition that allowed attackers to escalate privileges and create files anywhere on the system. The vulnerability, tracked as CVE-2025-55680, was discovered by security researchers at Exodus Intelligence in March 2024 and patched by Microsoft in October 2025, according to Exodus Intelligence.

It exists in the Windows Cloud Minifilter driver (cldflt.sys), which provides file system functionality for cloud applications such as OneDrive, and stems from the HsmpOpCreatePlaceholders() function’s handling of placeholder file creation.

The weakness is a time-of-check time-of-use race related to placeholder validation, enabling attackers to modify the filename in memory after validation but before file creation, potentially allowing arbitrary file creation in protected directories like C:\Windows\System32 and enabling DLL side-loading to obtain SYSTEM privileges. Administrators are urged to apply the October 2025 security updates to mitigate exploitation, especially for systems with cloud sync root directories configured.