Privilege Escalation Exploit Targets Windows Cloud Files Minifilter

Microsoft has addressed a critical race condition vulnerability in its Windows Cloud Files Minifilter driver, tracked as CVE-2025-55680, with patches issued in October 2025. The flaw, originally discovered in March 2024, affects the cldflt.sys component and enables a TOCTOU-like sequence that allows an attacker to bypass filename validation and place files anywhere on the system, effectively achieving privilege escalation.

The vulnerability stems from how the Windows Cloud Files Minifilter validates filenames when placeholder files are created via the CfCreatePlaceholders API, with a narrow window between validation and the actual file creation through FltCreateFileEx2. Exploitation involves manipulating a mapped memory region to alter the filename after validation but before file creation, potentially leveraging path traversal to target protected directories, and is reportedly capable of elevating privileges as a result.

Organisations running Windows systems with Cloud Files Minifilter enabled are urged to apply the October 2025 patches, with the risk documentation noting the issue as reported by Exodus Intelligence and highlighting the ongoing challenges of kernel-level security in cloud synchronisation scenarios, according to Exodus Intelligence.