Use after free in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. This flaw is a classic use‑after‑free, where an object is freed and then accessed again, enabling malicious code to manipulate privileged operations. The primary consequence is that a user with local access can gain higher or SYSTEM‑level rights without needing to authenticate remotely or exploit network services.

Affected Microsoft Windows and Windows Server releases include Windows 10, versions 1809, 21H2 and 22H2, Windows 11, versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2019, Windows Server 2022 and Windows Server 2025, both standard and Server Core installations. All these products contain the vulnerable Cloud Files Mini Filter Driver and are listed with the Microsoft CNA.

The CVSS score of 7.0 indicates moderate to high severity. The EPSS score of < 1% suggests a low probability that the vulnerability will be exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, meaning it has not yet been confirmed as a widely exploited exploit. The likely attack vector is local: an attacker who can run code with user privileges on a machine can trigger the use‑after‑free in the Cloud Files Mini Filter Driver to gain SYSTEM rights, compromising the entire device.