# CVE-2024-30085 Windows cldflt.sys Heap Overflow - Public Exploitation Techniques (PreviousMode and PPL Bypass Editions)

> A heap-based buffer overflow (CWE-122) in the Windows Cloud Files Mini-Filter Driver (cldflt.sys) lets a local, low-privileged user corrupt adjacent kernel pool memory and escalate to SYSTEM. Patched by Microsoft in June 2024, the bug was privately weaponized at TyphoonPWN 2024 as part of a VMware Workstation Guest-to-Host escape chain, then released as public PoC code by STAR Labs in December 2024 and a Metasploit module in 2025. In April 2026, researcher Alexandre Borges published a 106-page technical deep-dive (ER series article 09) detailing two new exploitation chains built on the same bug: a 'PreviousMode' variant that flips the kernel thread's addressing mode via WNF/ALPC/pipe-attribute corruption, and a 'PPL Bypass' variant that additionally strips Protected Process Light (PPL) protection from LSASS to dump credentials.

- **Published:** 2026-10-31T03:21:32Z
- **Last reviewed:** 2026-10-31T03:55:01.840Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4875
- **ID:** TL-2026-4875
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-30085, CVE-2025-62221

## Description

CVE-2024-30085 is a heap buffer overflow in the `HsmIBitmapNORMALOpen` routine of cldflt.sys, the Windows Cloud Files Mini-Filter Driver that backs OneDrive/cloud-placeholder file semantics. The function allocates a fixed 0x1000-byte paged-pool buffer to hold an `_HSM_DATA` reparse-point structure supplied via a crafted reparse tag, but does not validate that the attacker-controlled `Length` field (up to 0xFFFF) fits the allocation before calling `memcpy`, allowing up to roughly 0xEFFF bytes of controlled overflow into adjacent paged-pool allocations. Microsoft's fix (shipped in the June 2024 Patch Tuesday update, KB5039211) adds an explicit `cmp r14d, 0x1000` bounds check before the copy.

The vulnerability was originally discovered by Alex Birnberg (SSD Secure Disclosure) together with Gwangun Jung and Junoh Lee (Theori), and patched on 2024-06-11. A private, weaponized version of the exploit was demonstrated on 2024-05-30 at the TyphoonPWN 2024 competition as one stage of a VMware Workstation Guest-to-Host escape chain. On 2024-12-19, STAR Labs (researcher Cherie-Anne Lee) published a full root-cause analysis plus public PoC source (`poc.cpp`/`poc.h`) via the SSD Secure Disclosure GitHub (`star-sg/CVE`), followed by a detailed blog write-up on 2024-12-24 ('All I Want for Christmas is a CVE-2024-30085 Exploit'). The STAR Labs chain uses the initial overflow to corrupt an adjacent `_WNF_STATE_DATA` object and leak a kernel pointer through an ALPC handle table, then triggers a second WNF overflow to corrupt a `PipeAttribute` structure, which is forged in user space to obtain arbitrary kernel read and, via crafted `_KALPC_MESSAGE` structures, arbitrary write of token privilege fields — yielding SYSTEM privileges. The ALPC spraying approach reuses techniques published by Xu/Song/Li at Black Hat Asia 2022 and the `PipeAttribute` corruption method from Bayet/Fariello at SSTIC 2020; practical ALPC spray code from the earlier CVE-2023-36424 exploit was also referenced as a building block.

A Metasploit local-exploit module (`exploit/windows/local/cve_2024_30085_cloud_files`) targeting this same bug was folded into Rapid7's Metasploit Framework and documented in Rapid7's Metasploit wrap-up post dated 2025-03-28, making a weaponized, framework-integrated exploit broadly available to penetration testers and, potentially, attackers who obtain a foothold.

Most recently, Alexandre Borges' 'Exploiting Reversing' (ER) series continued its multi-part treatment of this CVE: article 08 (2026-03-31) was part 02, and article 09 (2026-04-28) is part 03, a 106-page document (with referenced demonstration videos) presenting two refined, end-to-end exploitation editions built on the same heap overflow primitive:

- **PreviousMode edition**: uses the WNF out-of-bounds primitive combined with ALPC and pipe-attribute corruption specifically to overwrite `_KTHREAD.PreviousMode`, tricking the kernel into treating subsequent user-mode pointers as kernel-mode addresses -- a classic Windows kernel-exploitation primitive that yields arbitrary kernel read/write and SYSTEM-level code execution without needing a full token-swap chain.
- **PPL Bypass edition**: extends the PreviousMode primitive to also clear/strip the `_EPROCESS.Protection` field of a target process, defeating Protected Process Light (PPL) enforcement. With PPL stripped from LSASS, the exploit chain invokes the `MiniDumpWriteDump` API against `lsass.exe` to extract NT password hashes, Kerberos tickets, and DPAPI master keys -- turning a local privilege-escalation bug into a full credential-theft primitive. Both editions include a multi-step cleanup/restoration phase that repairs the corrupted kernel structures (WNF state data, pipe attributes, thread mode) to avoid a crash-on-exit / bugcheck that would otherwise flag the exploitation attempt.

No confirmed criminal or nation-state in-the-wild exploitation of CVE-2024-30085 itself has been publicly reported; exploitation to date is documented from a security-competition demonstration (TyphoonPWN 2024) and public research/tooling releases. Because the underlying driver (cldflt.sys) ships on all supported Windows 10/11 and Windows Server releases and the new write-ups lower the bar to building a working PPL-bypass + LSASS-dumping chain, unpatched systems remain at meaningful risk and defenders should treat this as an active detection-engineering priority.

## MITRE ATT&CK

- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1106 Native API
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1003.001 OS Credential Dumping: LSASS Memory
- T1057 Process Discovery
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1587.004 Develop Capabilities: Exploits

## Sources

- [Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability - MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085)
- [NVD - CVE-2024-30085 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-30085)
- [All I Want for Christmas is a CVE-2024-30085 Exploit - STAR Labs](https://starlabs.sg/blog/2024/12-all-i-want-for-christmas-is-a-cve-2024-30085-exploit/)
- [Root Cause Analysis - CVE-2024-30085 - STAR Labs](https://onlyfm252.starlabs.sg/data/patch_diffs/rca-cve-2024-30085.md)
- [CVE-2024-30085 Public PoC Source (poc.cpp/poc.h) - star-sg/CVE](https://github.com/star-sg/CVE/tree/master/CVE-2024-30085)
- [Exploiting Reversing (ER) series: article 09 | Exploitation Techniques: CVE-2024-30085 (part 03)](https://exploitreversing.com/2026/04/28/exploiting-reversing-er-series-article-09/)
- [avleonov.com - cldflt tag (CVE-2024-30085 / CVE-2025-62221 tracking)](https://avleonov.com/tag/cldflt/)
- [CVE-2024-30085 Cloud Files Local Exploit - Rapid7 Vulnerability & Exploit Database](https://www.rapid7.com/db/vulnerabilities/exploit/windows/local/cve_2024_30085_cloud_files)
- [Metasploit Wrap-Up 03/28/2025 - Rapid7](https://www.rapid7.com/blog/post/2025/03/28/metasploit-wrap-up-03-28-2025/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4875