CVE-2026-80093

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver (affected versions not specified)

Description A type confusion and use-after-free issue exists in the Windows Cloud Files driver cldflt.sys, used by features like OneDrive Files On-Demand. The flaw is caused by a race condition between two threads operating on the pending request list OpenStream->RequestListHead. Specifically, the function CldiStreamProcessPendingHydrationRequests() temporarily inserts a LIST ENTRY sentinel from the kernel stack into the list, while CldStreamAbortOperation() traverses the same list assuming all entries are CLD STREAM REQUEST PARTIAL structures. If the second thread processes the sentinel, the kernel stack is misinterpreted as a CLD STREAM REQUEST PARTIAL structure, allowing a write operation through a bogus QueueContext pointer. An authorized local attacker can trigger this by registering a Cloud Files provider, creating a dehydrated placeholder, and initiating a read, then making parallel calls to CfAbortOperation() and CfDisconnectSyncRoot(). This can lead to a kernel crash or local privilege escalation.

Recommendations Apply the security updates released on September 8, 2026.