CVE-2025-62221
Microsoft Windows Use After Free Vulnerability
Description
CVE-2025-62221 is a high-severity use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver that enables local privilege escalation. With a CVSS v3.1 base score of 7.8, this flaw allows an authorized attacker with low-level privileges to elevate their privileges to SYSTEM level on affected Windows systems. The vulnerability affects multiple Windows versions including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2), and Windows Server 2019 and 2022. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 30, 2025, and carries an EPSS score of 0.0273 (85.7th percentile), indicating elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.8146 |
| microsoft | windows 10 21h2 | < 10.0.19044.6691 |
| microsoft | windows 10 22h2 | < 10.0.19045.6691 |
| microsoft | windows 11 23h2 | < 10.0.22631.6345 |
| microsoft | windows 11 24h2 | < 10.0.26100.7392 |
| microsoft | windows 11 25h2 | < 10.0.26200.7392 |
| microsoft | windows server 2019 | < 10.0.17763.8146 |
| microsoft | windows server 2022 | < 10.0.20348.4467 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2025 |
| microsoft | windows server 2025 | < 10.0.26100.7392 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62221(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-62221 is classified under CWE-416, which describes a condition where a program accesses memory through a pointer after the memory has been freed. In the context of the Windows Cloud Files Mini Filter Driver (cldflt.sys), this use-after-free occurs in kernel-mode code that manages cloud file synchronization operations. When the driver processes certain operations, it frees a memory object but retains a reference to it; subsequent use of this stale pointer in kernel context can be manipulated by an attacker to execute arbitrary code with SYSTEM privileges. Use-after-free vulnerabilities in kernel drivers are particularly severe because they operate at the highest privilege level, and exploitation can bypass all user-mode security controls including sandboxes, integrity levels, and access control lists. Learn more about CWE-416
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). Successful exploitation grants the attacker SYSTEM-level privileges on the affected Windows machine, which is the highest privilege level on a Windows system. This allows reading any file on the system regardless of access controls, modifying system configurations and security policies, installing persistent rootkits or backdoors, and creating or modifying user accounts.
Business Impact is significant across enterprise Windows environments. The vulnerability affects both workstation and server editions of Windows, including Windows Server 2019 and 2022, which are widely deployed in production environments. Privilege escalation from a standard user account to SYSTEM is a critical step in many attack chains, enabling lateral movement, credential harvesting, and domain compromise. The Cloud Files Mini Filter Driver is present on all Windows installations with cloud file synchronization capabilities, expanding the attack surface.
Exploitation Probability is elevated. The EPSS score of 0.0273 (85.7th percentile) indicates that this vulnerability is more likely to be exploited than approximately 86% of all known CVEs. Its inclusion in the CISA KEV catalog confirms that active exploitation has been observed. Local privilege escalation vulnerabilities are consistently valued by both red teams and threat actors as essential components of post-compromise attack chains. The ransomware association is listed as "Unknown" by CISA, but privilege escalation to SYSTEM is a standard prerequisite for ransomware deployment on enterprise networks.
Exploit Maturity
CVE-2025-62221 has confirmed active exploitation in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 30, 2025. The EPSS score of 0.0273 (85.7th percentile) further confirms elevated exploitation activity.
Microsoft has documented the vulnerability in its Security Update Guide and released patches through the standard Windows Update mechanism. Local privilege escalation vulnerabilities in Windows kernel drivers are highly sought after by threat actors because they provide a reliable method to escalate from initial access (typically as a standard user) to full system control. The Cloud Files Mini Filter Driver runs at kernel level, and exploitation of use-after-free conditions in kernel drivers is a well-researched technique with established exploitation methodologies. The ransomware association is listed as "Unknown" by CISA, but privilege escalation is a critical step in virtually all ransomware deployment playbooks, making this vulnerability a likely candidate for inclusion in ransomware toolkits.
Remediation
-
Apply Windows Security Updates — Install the latest cumulative security updates from Microsoft for all affected Windows versions. For Windows 10 1809 and Windows Server 2019, update to build 10.0.17763.8146 or later. For Windows 10 21H2/22H2, update to build 10.0.19044.6691/10.0.19045.6691 or later. For Windows 11 23H2, update to 10.0.22631.6345 or later. For Windows 11 24H2, update to 10.0.26100.7392 or later. For Windows 11 25H2, update to 10.0.26200.7392 or later. For Windows Server 2022, update to 10.0.20348.4467 or later. Refer to Microsoft's security advisory for complete version details.
-
Prioritize Server and Critical System Patching — Given that this vulnerability affects Windows Server editions and enables privilege escalation to SYSTEM, prioritize patching for domain controllers, file servers, and other critical infrastructure systems where privilege escalation poses the greatest risk.
-
Implement Least Privilege Policies — Ensure that standard users operate with the minimum privileges necessary for their role. While this does not prevent the vulnerability from being exploited (PR:L is sufficient), limiting initial access privileges reduces the opportunities for attackers to reach the vulnerable code path.
-
Deploy Endpoint Detection and Response — Configure EDR solutions to monitor for suspicious activity involving the Cloud Files Mini Filter Driver (cldflt.sys), including unusual kernel-mode operations, unexpected privilege transitions, and anomalous process creation with SYSTEM privileges following cloud file operations.
-
Monitor for Post-Exploitation Indicators — Watch for signs of privilege escalation such as new services being created by non-administrative users, unexpected scheduled tasks running as SYSTEM, credential dumping tools accessing LSASS, and lateral movement attempts originating from previously low-privilege accounts.
Technical Details
CVE-2025-62221 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys), a kernel-mode component that manages the synchronization of cloud-hosted files with the local filesystem. This driver is used by Windows features like OneDrive Files On-Demand and other cloud storage providers that integrate with the Windows cloud files API.
CVSS Vector Breakdown: The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates a local privilege escalation with low barriers. Attack Vector (AV:L) means the attacker needs local access to the system. Attack Complexity (AC:L) indicates no special conditions or race conditions are required. Privileges Required (PR:L) means the attacker needs a standard (non-administrative) user account. User Interaction (UI:N) means no action from another user is needed. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted due to the SYSTEM-level privilege gain.
Attack Mechanism: The attacker, operating as a low-privilege local user, triggers specific operations that cause the Cloud Files Mini Filter Driver to process cloud file synchronization requests in a way that leads to a memory object being freed while a reference to it is still held. The attacker manipulates the timing or sequence of operations to control the contents of the freed memory region, typically by performing a heap spray or grooming technique to place attacker-controlled data at the freed address. When the driver subsequently dereferences the stale pointer, it executes operations using the attacker-controlled data, which redirects execution flow to attacker-supplied code running in kernel context. Because kernel-mode code runs with SYSTEM privileges, the attacker achieves full privilege escalation from their initial low-privilege user context.
Frequently Asked Questions
What is the Windows Cloud Files Mini Filter Driver?
The Cloud Files Mini Filter Driver (cldflt.sys) is a kernel-mode Windows component that manages the synchronization of cloud-hosted files with the local filesystem. It is used by cloud storage solutions like OneDrive Files On-Demand to present cloud files in Windows Explorer and handle on-demand downloading and caching.
Can CVE-2025-62221 be exploited remotely?
No, the vulnerability requires local access (AV:L). An attacker must already have access to the target system with at least low-level privileges. However, this vulnerability is commonly chained with remote access vulnerabilities to achieve full system compromise in multi-stage attacks.
Which Windows versions are affected by CVE-2025-62221?
Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, and 25H2; and Windows Server 2019 and 2022 are all affected. Microsoft has released security updates for all impacted versions.
Is CVE-2025-62221 associated with ransomware?
CISA lists the ransomware association as "Unknown." However, local privilege escalation to SYSTEM is a critical component of virtually all ransomware deployment playbooks. Threat actors routinely use privilege escalation vulnerabilities to gain the access level needed to encrypt files, disable security tools, and deploy ransomware across enterprise networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.