Threat reportVulnerabilityTL-2026-4875
CVE-2024-30085 Windows cldflt.sys Heap Overflow - Public Exploitation Techniques (PreviousMode and PPL Bypass Editions)
CVE-2024-30085 Windows cldflt.sys Heap Overflow (TL-2026-4875) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-10-31. It has no confirmed attribution, affects Microsoft Windows Cloud Files Mini Filter Driver (cldflt.sys), references 2 CVEs (CVE-2024-30085, CVE-2025-62221), maps to 9 MITRE ATT&CK techniques (T1003.001, T1057, T1106), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4875
- Threat ID
- TL-2026-4875
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors running windows endpoints and servers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in CVE-2024-30085 Windows cldflt.sys Heap Overflow
Malware and tooling: IDA Pro / Hex-Rays decompiler, Metasploit Framework (exploit/windows/local/cve_2024_30085_cloud_files)
How CVE-2024-30085 Windows cldflt.sys Heap Overflow works
A heap-based buffer overflow (CWE-122) in the Windows Cloud Files Mini-Filter Driver (cldflt.sys) lets a local, low-privileged user corrupt adjacent kernel pool memory and escalate to SYSTEM. Patched by Microsoft in June 2024, the bug was privately weaponized at TyphoonPWN 2024 as part of a VMware Workstation Guest-to-Host escape chain, then released as public PoC code by STAR Labs in December 2024 and a Metasploit module in 2025. In April 2026, researcher Alexandre Borges published a 106-page technical deep-dive (ER series article 09) detailing two new exploitation chains built on the same bug: a 'PreviousMode' variant that flips the kernel thread's addressing mode via WNF/ALPC/pipe-attribute corruption, and a 'PPL Bypass' variant that additionally strips Protected Process Light (PPL) protection from LSASS to dump credentials.
CVE-2024-30085 is a heap buffer overflow in the `HsmIBitmapNORMALOpen` routine of cldflt.sys, the Windows Cloud Files Mini-Filter Driver that backs OneDrive/cloud-placeholder file semantics. The function allocates a fixed 0x1000-byte paged-pool buffer to hold an `_HSM_DATA` reparse-point structure supplied via a crafted reparse tag, but does not validate that the attacker-controlled `Length` field (up to 0xFFFF) fits the allocation before calling `memcpy`, allowing up to roughly 0xEFFF bytes of controlled overflow into adjacent paged-pool allocations. Microsoft's fix (shipped in the June 2024 Patch Tuesday update, KB5039211) adds an explicit `cmp r14d, 0x1000` bounds check before the copy.
The vulnerability was originally discovered by Alex Birnberg (SSD Secure Disclosure) together with Gwangun Jung and Junoh Lee (Theori), and patched on 2024-06-11. A private, weaponized version of the exploit was demonstrated on 2024-05-30 at the TyphoonPWN 2024 competition as one stage of a VMware Workstation Guest-to-Host escape chain. On 2024-12-19, STAR Labs (researcher Cherie-Anne Lee) published a full root-cause analysis plus public PoC source (`poc.cpp`/`poc.h`) via the SSD Secure Disclosure GitHub (`star-sg/CVE`), followed by a detailed blog write-up on 2024-12-24 ('All I Want for Christmas is a CVE-2024-30085 Exploit'). The STAR Labs chain uses the initial overflow to corrupt an adjacent `_WNF_STATE_DATA` object and leak a kernel pointer through an ALPC handle table, then triggers a second WNF overflow to corrupt a `PipeAttribute` structure, which is forged in user space to obtain arbitrary kernel read and, via crafted `_KALPC_MESSAGE` structures, arbitrary write of token privilege fields — yielding SYSTEM privileges. The ALPC spraying approach reuses techniques published by Xu/Song/Li at Black Hat Asia 2022 and the `PipeAttribute` corruption method from Bayet/Fariello at SSTIC 2020; practical ALPC spray code from the earlier CVE-2023-36424 exploit was also referenced as a building block.
A Metasploit local-exploit module (`exploit/windows/local/cve_2024_30085_cloud_files`) targeting this same bug was folded into Rapid7's Metasploit Framework and documented in Rapid7's Metasploit wrap-up post dated 2025-03-28, making a weaponized, framework-integrated exploit broadly available to penetration testers and, potentially, attackers who obtain a foothold.
Most recently, Alexandre Borges' 'Exploiting Reversing' (ER) series continued its multi-part treatment of this CVE: article 08 (2026-03-31) was part 02, and article 09 (2026-04-28) is part 03, a 106-page document (with referenced demonstration videos) presenting two refined, end-to-end exploitation editions built on the same heap overflow primitive:
- **PreviousMode edition**: uses the WNF out-of-bounds primitive combined with ALPC and pipe-attribute corruption specifically to overwrite `_KTHREAD.PreviousMode`, tricking the kernel into treating subsequent user-mode pointers as kernel-mode addresses -- a classic Windows kernel-exploitation primitive that yields arbitrary kernel read/write and SYSTEM-level code execution without needing a full token-swap chain. - **PPL Bypass edition**: extends the PreviousMode primitive to also clear/strip the `_EPROCESS.Protection` field of a target process, defeating Protected Process Light (PPL) enforcement. With PPL stripped from LSASS, the exploit chain invokes the `MiniDumpWriteDump` API against `lsass.exe` to extract NT password hashes, Kerberos tickets, and DPAPI master keys -- turning a local privilege-escalation bug into a full credential-theft primitive. Both editions include a multi-step cleanup/restoration phase that repairs the corrupted kernel structures (WNF state data, pipe attributes, thread mode) to avoid a crash-on-exit / bugcheck that would otherwise flag the exploitation attempt.
No confirmed criminal or nation-state in-the-wild exploitation of CVE-2024-30085 itself has been publicly reported; exploitation to date is documented from a security-competition demonstration (TyphoonPWN 2024) and public research/tooling releases. Because the underlying driver (cldflt.sys) ships on all supported Windows 10/11 and Windows Server releases and the new write-ups lower the bar to building a working PPL-bypass + LSASS-dumping chain, unpatched systems remain at meaningful risk and defenders should treat this as an active detection-engineering priority.
MITRE ATT&CK techniques used in TL-2026-4875
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Discovery
Execution
Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1611 Escape to Host
Defense Evasion
T1211 Exploitation for Stealth
Resource Development
T1588.005 Exploits; T1588.006 Vulnerabilities
defense-impairment
Affected products and versions in CVE-2024-30085 Windows cldflt.sys Heap Overflow
- Microsoft — Windows Cloud Files Mini Filter Driver (cldflt.sys)
Vulnerable versions: Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows 11 21H2; Windows 11 22H2; Windows 11 23H2; Windows Server 2019; Windows Server 2022
Fixed in: Windows 10 22H2 with KB5039211; All affected builds with June 2024 cumulative update or later
Remediation for CVE-2024-30085 Windows cldflt.sys Heap Overflow
Patches
- KB5039211 (Microsoft June 2024 Patch Tuesday) - adds a bounds check (`cmp r14d, 0x1000`) in HsmIBitmapNORMALOpen before the vulnerable memcpy.
Immediate actions
- Apply the June 2024 Microsoft cumulative update (KB5039211) that patches CVE-2024-30085 on all affected Windows 10, Windows 11, and Windows Server systems.
- Verify patch status via vulnerability scanning/CMDB for any endpoints still exposing unpatched cldflt.sys builds.
- Enable LSA Protection (RunAsPPL) and Credential Guard to raise the bar against the PPL-bypass + LSASS-dumping edition of the exploit chain.
- Alert and investigate any unexpected handle/process access to lsass.exe combined with MiniDumpWriteDump-style API calls from non-security-tool processes.
Workarounds
- No supported workaround beyond patching exists for cldflt.sys, since the driver is required for OneDrive/cloud-placeholder file functionality; where feasible, restrict or disable Cloud Files API usage on high-value hosts pending patch deployment.
Longer-term hardening
- Deploy EDR/ETW-based kernel telemetry capable of flagging anomalous WNF state-data writes, ALPC message spraying, and pipe-attribute manipulation from user-mode processes.
- Instrument and alert on cldflt.sys fault/bugcheck events and unusual reparse-point operations against cloud-placeholder files.
- Maintain an accelerated patch cadence for Windows kernel-mode driver CVEs with public PoC code, given the historical pattern of competition PoCs (TyphoonPWN) becoming public exploits within months.
- Periodically re-validate detection content against newly published exploitation research (e.g., the Exploiting Reversing ER series) for this driver family.
CVEs associated with CVE-2024-30085 Windows cldflt.sys Heap Overflow
Weaknesses (CWE) in CVE-2024-30085 Windows cldflt.sys Heap Overflow
Timeline of CVE-2024-30085 Windows cldflt.sys Heap Overflow
- A private, weaponized exploit for the cldflt.sys heap overflow is demonstrated at the TyphoonPWN 2024 competition as a stage in a VMware Workstation Guest-to-Host escape chain.
- Microsoft publishes the CVE-2024-30085 advisory and ships a fix (KB5039211, June 2024 Patch Tuesday) adding a bounds check to HsmIBitmapNORMALOpen in cldflt.sys.
- STAR Labs (Cherie-Anne Lee) publishes a root-cause analysis and public proof-of-concept source code (poc.cpp/poc.h) for CVE-2024-30085 via the star-sg/CVE GitHub repository.
- STAR Labs publishes the detailed exploitation write-up 'All I Want for Christmas is a CVE-2024-30085 Exploit', describing the WNF/ALPC/PipeAttribute exploit chain to SYSTEM privileges.
- A Metasploit local-exploit module (exploit/windows/local/cve_2024_30085_cloud_files) targeting CVE-2024-30085 is documented in Rapid7's Metasploit wrap-up, broadening availability of a weaponized exploit.
- Alexandre Borges publishes Exploiting Reversing (ER) series article 08 (part 02), continuing technical analysis of CVE-2024-30085 exploitation.
- Alexandre Borges publishes ER series article 09 (part 03), a 106-page write-up presenting two new exploitation editions for CVE-2024-30085: a PreviousMode privilege-escalation chain and a PPL Bypass chain that adds LSASS credential extraction via MiniDumpWriteDump.
Sources cited for CVE-2024-30085 Windows cldflt.sys Heap Overflow
- Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability - MSRC
- NVD - CVE-2024-30085 Detail
- All I Want for Christmas is a CVE-2024-30085 Exploit - STAR Labs
- Root Cause Analysis - CVE-2024-30085 - STAR Labs
- CVE-2024-30085 Public PoC Source (poc.cpp/poc.h) - star-sg/CVE
- Exploiting Reversing (ER) series: article 09 | Exploitation Techniques: CVE-2024-30085 (part 03)
- avleonov.com - cldflt tag (CVE-2024-30085 / CVE-2025-62221 tracking)
- CVE-2024-30085 Cloud Files Local Exploit - Rapid7 Vulnerability & Exploit Database
- Metasploit Wrap-Up 03/28/2025 - Rapid7
Detection coverage for TL-2026-4875
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4875 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.