Windows Cloud Files Driver CVE-2025-62221 Zero-Day

What to do

1. Compare every host's build and UBR with the December 2025 fixed builds and install the latest cumulative update on anything older.
2. Enroll remaining Windows 10 22H2 devices in Extended Security Updates or upgrade them; unenrolled devices will never get this fix.
3. Patch multi-user hosts first: Remote Desktop servers, VDI pools and shared workstations.
4. Keep EDR on every host; this bug is used after an attacker already runs code as a normal user.

How to check if you are affected or compromised

• Hunt EDR history from before your December 2025 patch date for low-privilege processes that spawned SYSTEM processes, or for new services and drivers.
• Check crash dumps and System log bugchecks (Event ID 1001) on unpatched hosts for faults that name cldflt.sys.
• Confirm the patched driver is in place: compare the file version of C:\Windows\System32\drivers\cldflt.sys before and after the update across the fleet.

What happened#

On December 9, 2025, Microsoft fixed CVE-2025-62221, a use-after-free (CWE-416) in the Windows Cloud Files Mini Filter Driver, cldflt.sys. It was the only bug that month that Microsoft marked "Exploitation Detected." The advisory says an authorized local attacker can use it to gain SYSTEM privileges. Microsoft's own threat intelligence (MSTIC) and MSRC are credited with the find.

Microsoft scores it CVSS 3.1 7.8, with low privileges, low complexity and no user interaction, per the CVE record. CISA added it to the KEV catalog the same day, with a December 30, 2025 federal deadline.

Who used it, and how, has not been disclosed as of Oct 23, 2026. The Hacker News reported that "it's currently not known how the vulnerability is being abused in the wild and in what context." It quoted Rapid7's Adam Barnett: "The Cloud Files minifilter is used by OneDrive, Google Drive, iCloud, and others." Action1's Mike Walters said an attacker could gain a foothold through phishing or a browser exploit, then "chain it with CVE-2025-62221 to seize control of the host."

Who is affected#

Windows 10 1809, 21H2 and 22H2; Windows 11 23H2, 24H2 and 25H2; and Windows Server 2019, 2022 and 2025. Fixed builds include 26100.7462 for Windows 11 24H2 and Server 2025, 22631.6345 for Windows 11 23H2, 20348.4529 for Server 2022, 17763.8146 for Server 2019 and 19045.6691 for Windows 10 22H2. The driver is part of Windows, so removing OneDrive does not remove the risk.

Do you really need to act?#

For patched fleets, no. Like the November kernel zero-day CVE-2025-62215, this is a second-stage bug. It turns a normal user foothold into full control of the machine. Two groups still carry real risk. The first is hosts that fell behind on updates. The second is Windows 10 22H2 devices outside Extended Security Updates. Windows 10 support ended on October 14, 2025, so those devices never received this fix and never will.

This driver has been exploited before. CVE-2023-36036, another Cloud Files Mini Filter Driver privilege escalation, was exploited as a zero-day and added to KEV on November 14, 2023. Expect attackers to keep probing it.

What to do now#

1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion,CurrentBuild,UBR, and install the latest cumulative update on anything below the December 2025 build.
2. Find Windows 10 22H2 devices without ESU and enroll or upgrade them.
3. Patch multi-user hosts first, such as Remote Desktop servers and VDI pools.
4. Keep EDR on every host to catch the escalation step.

How to tell if you were hit#

None of the sources above publish indicators of compromise. On hosts that stayed unpatched after December 2025, hunt EDR history for low-privilege processes that spawned SYSTEM processes, and for new services or drivers. Check crash dumps and bugchecks (System log Event ID 1001) for faults that name cldflt.sys, since failed use-after-free attempts can crash a machine. To confirm the driver is updated, run (Get-Item C:\Windows\System32\drivers\cldflt.sys).VersionInfo.FileVersion and compare across hosts. fltmc filters shows whether CldFlt is loaded.

Timeline#

• Nov 14, 2023 — An earlier Cloud Files driver zero-day, CVE-2023-36036, is fixed and added to KEV.
• Oct 14, 2025 — Windows 10 support ends; later fixes for it ship only through ESU.
• Dec 9, 2025 — Microsoft fixes CVE-2025-62221 and reports exploitation; CISA adds it to KEV.
• Dec 30, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2025-62221 · KEV 2025-12-09 · Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — CVE-2025-62221 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability msrc.microsoft.com
2. CVE record — CVE-2025-62221 cve.org
3. NVD — CVE-2025-62221 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-62221 cisa.gov
5. Microsoft — Windows 10 end of support microsoft.com
6. CVE record — CVE-2023-36036 cve.org

Coverage and analysis

1. The Hacker News — Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days thehackernews.com