Brief Summary: CVE-2026-34337 — Windows Cloud Files Mini Filter Driver Use After Free Privilege Escalation

Introduction

A use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, patched in the May 2026 Patch Tuesday cycle, gives any low-privilege local user a reliable path to SYSTEM-level access. With a CVSS score of 7.8, low attack complexity, and no user interaction required, CVE-2026-34337 is a meaningful post-compromise escalation primitive for attackers who already have a foothold on a Windows machine.

The context makes this fix worth attention. Microsoft patched three separate Elevation of Privilege vulnerabilities in the same cldflt.sys driver in a single update cycle, all with identical severity ratings. That kind of clustering in a kernel-mode component signals that the driver has been under serious scrutiny and should be patched promptly.

Technical Information

The Vulnerable Component

The Windows Cloud Files Mini Filter Driver (cldflt.sys) is a kernel-mode file system mini filter that underpins cloud file synchronization in Windows, including OneDrive's Files On Demand functionality. As a mini filter driver, it runs at a privileged level in the Windows I/O stack, where it intercepts and processes file system requests before they reach the underlying file system driver.

Root Cause

CVE-2026-34337 comes from two interrelated software weaknesses:

1. CWE-416 (Use After Free): The driver frees a memory object but fails to invalidate all references to it. A later operation dereferences the stale pointer and accesses memory that may have been reallocated for a different purpose.
2. CWE-362 (Race Condition): Concurrent execution paths in the driver share a resource without proper synchronization. This opens a timing window in which one thread can free an object while another thread still holds and uses a reference to it.

The patch addresses both issues. It makes sure memory references are properly invalidated before deallocation, and it prevents concurrent execution paths from triggering a stale pointer dereference.

CVSS Breakdown

The full CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which tells us quite a bit about the exploitation profile:

The low attack complexity rating stands out most. For a vulnerability built on a race condition, it indicates that the timing window is neither narrow nor hard to hit, so exploitation does not require precise environmental conditions or repeated attempts.

Attack Flow

Based on the CWE classifications and CVSS metrics, the exploitation path would follow this general sequence:

1. An attacker with low-privilege local access identifies the vulnerable cldflt.sys driver on the target system.
2. The attacker triggers concurrent operations against the Cloud Files Mini Filter Driver and uses the race condition to open a window in which a memory object is freed while another execution path still holds a reference to it.
3. The attacker manipulates the freed memory region (for example, through heap spraying or controlled allocation) so that when the stale pointer is dereferenced, execution is redirected to attacker-controlled code.
4. Because cldflt.sys runs in kernel mode, successful exploitation yields SYSTEM-level privileges and full control over the machine.

No proof-of-concept code or detailed exploitation methodology has been publicly disclosed. The sequence above comes strictly from the CWE classifications, CVSS metrics, and patch description that Microsoft provided.

Patch Information

Microsoft released the official fix for CVE-2026-34337 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The MSRC advisory lists the Remediation Level as "Official Fix." No workarounds or configuration-based mitigations exist. The only remediation path is to install the appropriate cumulative security update.

The following table lists the relevant Knowledge Base articles and minimum fixed build numbers:

For Windows 11 24H2/25H2, Windows Server 2022, and Windows Server 2025, Microsoft provides both a standard cumulative update and a Security Hotpatch Update. The hotpatch updates can be applied without a reboot, which is particularly useful for production servers. Hotpatch builds carry slightly different build numbers than the full cumulative update, so administrators should verify they are running at least the build number listed above.

To confirm deployment, run winver or check the systeminfo output, and make sure the build number meets or exceeds the fixed version for the relevant product.

Affected Systems and Versions

Based on the patch matrix, the following Windows versions are confirmed affected:

• Windows 10 Version 1809 (builds prior to 10.0.17763.8755)
• Windows 10 Version 21H2 (builds prior to 10.0.19044.7291)
• Windows 10 Version 22H2 (builds prior to 10.0.19045.7291)
• Windows 11 Version 23H2 (builds prior to 10.0.22631.7079)
• Windows 11 Version 24H2 (builds prior to 10.0.26100.8457)
• Windows 11 Version 25H2 (builds prior to 10.0.26200.8457)
• Windows 11 Version 26H1 (builds prior to 10.0.28000.2113)
• Windows Server 2019 (builds prior to 10.0.17763.8755)
• Windows Server 2022 (builds prior to 10.0.20348.5139)
• Windows Server 2022, 23H2 Edition (builds prior to 10.0.25398.2330)
• Windows Server 2025 (builds prior to 10.0.26100.32860)

Any system running the Cloud Files Mini Filter Driver (cldflt.sys) at a version below the patched build is vulnerable. Because this driver supports OneDrive Files On Demand and similar cloud sync features, it is present on a wide range of default Windows installations.

Vendor Security History

The May 2026 Patch Tuesday release addressed between 120 and 137 vulnerabilities, none of which were zero days or actively exploited at the time of release. The Windows Cloud Files Mini Filter Driver accounted for three separate Elevation of Privilege vulnerabilities in that batch, all rated Important with a CVSS score of 7.8:

Three vulnerabilities in a single kernel-mode driver suggest that the component underwent focused security review, either by external researchers or by internal Microsoft teams. Microsoft's vulnerability management process, with monthly coordinated releases, an Exploitability Index, and active bug bounty programs, continues to give defenders a predictable remediation cadence.

References

• MSRC Advisory: CVE-2026-34337
• NVD: CVE-2026-34337
• CVE Record: CVE-2026-34337
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• SANS Internet Storm Center: Microsoft May 2026 Patch Tuesday
• Zero Day Initiative: The May 2026 Security Update Review
• Microsoft Bounty Programs
• Desktop OS Market Share Worldwide (StatCounter)
• KB5087538 (Windows 10 1809 / Server 2019)
• KB5087544 (Windows 10 21H2 / 22H2)
• KB5087420 (Windows 11 23H2)
• KB5089549 (Windows 11 24H2 / 25H2)
• KB5089466 (Hotpatch for Windows 11 24H2 / 25H2)
• KB5089548 (Windows 11 26H1)
• KB5087545 (Windows Server 2022)
• KB5087424 (Hotpatch for Windows Server 2022)
• KB5087541 (Windows Server 2022, 23H2)
• KB5087539 (Windows Server 2025)
• KB5087423 (Hotpatch for Windows Server 2025)