Threadlinqs Intelligence is tracking the public release of 'MiniPlasma', a Windows local privilege escalation zero-day disclosed on GitHub on 2026-05-15 by serial zero-day dropper 'Chaotic Eclipse' (Twitter/X handle @nightmare_eclipse). The release includes both annotated C++ source and a precompiled x64 binary, and is the sixth unauthenticated SYSTEM LPE the persona has dumped publicly in 2026 following BlueHammer (Win32k), RedSun (afd.sys), UnDefend (Windows Defender Application Control bypass), YellowKey (CNG.sys), and GreenPlasma (DWM).

## Root Cause

MiniPlasma is a verbatim regression of CVE-2020-17103, originally reported in October 2020 by James Forshaw of Google Project Zero (issue 2096) and nominally patched in the December 2020 Patch Tuesday. The vulnerability lives in the Windows Cloud Files Mini Filter driver (cldflt.sys), the kernel component that backs the Cloud Sync Engine API used by OneDrive, iCloud, Google Drive File Stream, and other namespace virtualization providers. The driver exposes a set of FSCTL_HSM_* control codes — among them FSCTL_HSM_CONTROL_ABORT_HYDRATION, reached from user mode through the undocumented CfAbortHydration helper in cldapi.dll.

Forshaw's 2020 root-cause analysis showed that the HsmOsBlockPlaceholderAccess routine, which fans out from FSCTL_HSM_CONTROL_ABORT_HYDRATION, calls HsmpOpenOrCreatePlaceholderKey to open or create registry keys describing the placeholder's hydration state. The function builds a registry path under \Registry\User\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\CloudStore using attacker-controllable PathLength/Path fields from the FSCTL input buffer, then calls ZwCreateKey with KernelMode access — bypassing the SeAccessCheck that would otherwise enforce that an unprivileged caller cannot write to .DEFAULT. The December 2020 patch added a SeAccessCheck against an explicit Cloud Files security descriptor; the MiniPlasma drop demonstrates that a code path through CfAbortHydration → HsmiBlockPlaceholderAccess still reaches HsmpOpenOrCreatePlaceholderKey on a fast path that does not perform the post-patch check, re-introducing the same primitive.

## Exploit Chain

1. Low-privileged user runs MiniPlasma.exe (no UAC bypass required — the exploit assumes a standard user shell). 2. The exploit loads cldapi.dll and resolves CfAbortHydration. It also opens a handle to a sacrificial placeholder file under %LOCALAPPDATA%\MiniPlasma\ that has the FILE_ATTRIBUTE_RECALL_ON_OPEN reparse tag, allowing the driver to treat it as a Cloud Files placeholder without a real sync root registration. 3. CfAbortHydration is called with a hand-crafted CF_OPERATION_PARAMETERS structure whose key-path field embeds the absolute target \Registry\User\.DEFAULT\Environment with a UserInitMprLogonScript value pointing at the payload DLL. 4. cldflt.sys reaches HsmpOpenOrCreatePlaceholderKey with KernelMode and writes the value into the .DEFAULT hive without an access check. 5. The exploit triggers a Winlogon refresh by invoking RpcWinlogonNotifyEvent or, more reliably, by waiting for the next interactive logon. UserInitMprLogonScript is honored by userinit.exe under the SYSTEM context during early Winlogon, executing the payload as NT AUTHORITY\SYSTEM. 6. The shipped PoC payload spawns cmd.exe /K whoami /priv as SYSTEM in the active session.

## Affected Surface

Dormann's testing confirms the PoC succeeds on Windows 11 Pro 23H2 (build 22631.x) and Windows 11 Pro 24H2 (build 26100.x) with May 2026 cumulative updates installed. Exploitation fails on Windows 11 Insider Preview Canary builds (26200+), implying that Microsoft has internal-only mitigation work staged. Windows Server 2022 and Server 2025 ship the same cldflt.sys binary and are presumed vulnerable but not yet independently confirmed. Windows 10 22H2 and Windows Server 2019 were patched against the original CVE-2020-17103 and have not been retested.

## Defensive Posture

No vendor patch exists at the time of publication. Microsoft has acknowledged receipt of the report but has not assigned a new CVE or committed to a fix window. AppLocker / WDAC policies that block unsigned binaries from user-writable directories will stop the shipped PoC binary but not a recompiled variant. EDR detection should focus on: (a) unusual writes to HKU\.DEFAULT\Environment\UserInitMprLogonScript, (b) cldflt.sys handle opens from non-sync-engine processes, and (c) FSCTL_HSM_CONTROL_ABORT_HYDRATION operations against files outside known sync roots. Disabling the Windows Cloud Files Filter Driver service (cldflt) breaks OneDrive Files On-Demand and Files Restore but mitigates the bug entirely.

## Attribution and Disclosure Context

'Chaotic Eclipse' / 'Nightmare Eclipse' is an unattributed individual researcher persona that has, over the past six months, released six unauthenticated Windows kernel LPE PoCs as full-drop disclosures with no coordination. Threat intelligence vendors (Mandiant, Volexity, Microsoft MSTIC) have reported in-the-wild use of the BlueHammer and GreenPlasma PoCs by financially-motivated ransomware affiliates within 72 hours of public release. MiniPlasma is expected to follow the same trajectory; SOC teams should treat any unexplained SYSTEM token impersonation chained from a standard-user process as a high-confidence indicator.