Cisco Talos disclosed CVE-2026-58613, a kernel use-after-free in cldflt.sys — the Windows Cloud Files Mini Filter Driver behind OneDrive Files On-Demand. An orphaned provider-progress request, an eroded stream-context refcount, and the driver's 60-second watchdog timer combine to free a pool block mid-function and dereference it, giving a local attacker a path to SYSTEM.

A researcher known as Chaotic Eclipse has released the MiniPlasma proof-of-concept exploit, claiming it can still gain SYSTEM privileges on fully patched Windows 11 systems through the cldflt.sys Cloud Filter driver. The disclosure adds to a series of recent Windows zero-days from the same researcher, including BlueHammer, RedSun, YellowKey, and GreenPlasma. #MiniPlasma #ChaoticEclipse #cldfltsys #GoogleProjectZero #Microsoft

Resolve the CldFlt service failed to start error using Command Prompt, the Registry Editor, and other tools available on Windows.