Trending Now - Zero-day Exploit in Windows Allows SYSTEM Privilege Escalation

WHO:

The Hacker News - Chaotic Eclipse, a security researcher, is behind the disclosure of the Windows flaws.

The Hacker News - James Forshaw, a researcher from Google Project Zero, originally reported the flaw to Microsoft.

BleepingComputer - Will Dormann, principal vulnerability analyst at Tharros, confirmed the exploit's functionality.

WHAT:

The Hacker News - A proof-of-concept (PoC) for a Windows privilege escalation zero-day flaw, codenamed MiniPlasma, has been released.

BleepingComputer - The MiniPlasma exploit allows attackers to gain SYSTEM privileges on fully patched Windows systems.

The Hacker News - The vulnerability impacts "cldflt.sys," specifically in the "HsmOsBlockPlaceholderAccess" routine.

BleepingComputer - The exploit was tested on a fully patched Windows 11 Pro system, successfully opening a command prompt with SYSTEM privileges.

BleepingComputer - Microsoft addressed another privilege escalation flaw in December 2025, identified as CVE-2025-62221, with a CVSS score of 7.8.

WHERE:

The Hacker News - The vulnerability affects all Windows versions.

WHEN:

The Hacker News - The flaw was originally reported to Microsoft in September 2020.

The Hacker News - The flaw was reportedly fixed in December 2020 as part of CVE-2020-17103.

BleepingComputer - The exploit was confirmed to work on Windows 11 systems running the latest May 2026 updates.

WHY:

The Hacker News - Chaotic Eclipse claims that Microsoft either never patched the issue or rolled back the patch for unknown reasons.

BleepingComputer - Chaotic Eclipse publicly disclosed the Windows zero-days in protest of Microsoft's bug bounty and vulnerability-handling process.

HOW:

The Hacker News - The exploit abuses how the Windows Cloud Filter driver handles registry key creation through an undocumented CfAbortHydration API.

BleepingComputer - The original PoC by Google worked without any changes, and the researcher weaponized it to spawn a SYSTEM shell.

(UPDATED May 18, 2026 17:45 UTC)

A security researcher known as Chaotic Eclipse has disclosed a proof-of-concept for a Windows privilege escalation zero-day flaw, codenamed MiniPlasma, which allows attackers to gain SYSTEM privileges on fully patched Windows systems. This vulnerability, affecting all Windows versions, specifically targets the "cldflt.sys" file and was confirmed to work on Windows 11 systems with the latest updates as of May 2026. Chaotic Eclipse claims that Microsoft either failed to properly patch the issue or may have rolled back the fix, leading to this public disclosure in protest of the company's handling of vulnerabilities.