PoC Exploit Released for CVE-2025-55680 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Flaw

PoC exploit has been released for CVE-2025-55680, a Windows Cloud Files Mini Filter Driver elevation-of-privilege flaw, researchers from TyphoonPWN and the Windows PE Winner team, in collaboration with SSD Secure Disclosure, have disclosed a time-of-check to time-of-use race condition that could allow a local attacker to rise to SYSTEM.

The vulnerability carries a CVSS score of 7.8 and acts as a patch bypass for CVE-2020-17136, with the flaw arising from how the driver handles placeholder file creation and memory-mapped path strings obtained from user-controlled memory. According to the researchers, the TOCTOU condition can be exploited via memory mapping to bypass a prior check that disallowed certain characters, enabling arbitrary file write and full system control.

Microsoft addressed this flaw as part of its October Patch Tuesday, and admins are urged to apply the latest security updates immediately to mitigate the vulnerability. The full technical write-up and exploit details are available via SSD Secure Disclosure.