Researcher Details Windows Cloud Files Mini Filter Driver Elevation of Privilege Flaw (CVE-2025-55680)

Researchers from Exodus Intelligence, led by Michele Campa, have disclosed a privilege-escalation vulnerability in Microsoft’s Cloud Files Minifilter driver (cldflt.sys) that affects all versions of Windows prior to October 2025, assigned CVE-2025-55680 with a CVSS of 7.8.

The flaw stems from a race condition in how the driver validates and creates placeholder files via the CfCreatePlaceholders API, specifically in the HsmpOpCreatePlaceholders() function, where a small time window exists between filename validation and file creation. During this interval, a user-supplied filename can be altered, and because the kernel maps user memory into its address space, such mid-race modification can affect the kernel view and enable arbitrary file or directory creation outside the sync root.

In practice, the exploit can inject backslash characters into the validated filename just before a FltCreateFileEx2() call, allowing traversal to protected directories such as C:\Windows\System32 and enabling DLL side-loading to achieve SYSTEM-level code execution. Microsoft addressed CVE-2025-55680 in its October 2025 Patch Tuesday release, and users are urged to install the latest Windows security updates immediately according to Microsoft. Enterprises relying on OneDrive Files On Demand, SharePoint sync, or other Cloud Files API services are particularly exposed to this vulnerability.