CVE-2025-62221
Description
CVE-2025-62221 is a high-severity privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver, currently under active exploitation.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| windows_10_1809 | * | 10.0.17763.8146 | vulnerable |
| windows_10_1809 | * | 10.0.17763.8146 | vulnerable |
| windows_10_21h2 | * | 10.0.19044.6691 | vulnerable |
| windows_10_22h2 | * | 10.0.19045.6691 | vulnerable |
| windows_11_23h2 | * | 10.0.22631.6345 | vulnerable |
| windows_11_24h2 | * | 10.0.26100.7392 | vulnerable |
| windows_11_25h2 | * | 10.0.26200.7392 | vulnerable |
| windows_server_2019 | * | 10.0.17763.8146 | vulnerable |
| windows_server_2022 | * | 10.0.20348.4467 | vulnerable |
| windows_server_2022_23h2 | * | 10.0.25398.2025 | vulnerable |
| windows_server_2025 | * | 10.0.26100.7392 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest security updates from Microsoft specifically addressing the January 2025 (or later) cumulative update cycle to patch the cldflt.sys driver.
Update affected systems
Ensure Windows 10, Windows 11, and Windows Server systems are updated to versions exceeding the vulnerable builds, such as build 10.0.19045.6691 for Windows 10 22H2 or 10.0.26100.7392 for Windows 11 24H2.
Restrict access
Limit local interactive login privileges to essential personnel only. Since this vulnerability requires local access, enforcing the principle of least privilege (PoLP) significantly reduces the available attack surface.
Monitor for exploitation
Utilize Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation originating from the Cloud Files Mini Filter Driver and track unauthorized attempts to escalate to SYSTEM privileges.
Detection Guidance
Detecting exploitation of CVE-2025-62221 involves monitoring for system instability or crashes related to the cldflt.sys driver, often logged as bug checks 0x3B or 0x9E. Security teams should use EDR tools to hunt for unusual memory manipulation patterns or processes spawned by standard users that suddenly exhibit SYSTEM-level permissions. Watch for unauthorized calls to the Cloud Files API that deviate from normal cloud-sync application behavior.