CVE-2023-36036: Windows Cloud Files Mini Filter Driver heap overflow privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a local privilege escalation with a CVSS of 7.8 and confirmed active exploitation in CISA KEV, though it requires an existing local foothold rather than remote access.

What it is

CVE-2023-36036 is a heap-based buffer overflow and out-of-bounds write in the Windows Cloud Files Mini Filter Driver that allows a local user to elevate privileges. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft has issued a patch. Because it is listed in CISA KEV, it is being exploited in the wild and should be treated as urgent.

Impact

A local attacker who can run code on the host can exploit the memory corruption to gain SYSTEM-level privileges. That access can then be used to disable defenses, move laterally or deploy additional payloads.

Attack surface

The CVSS vector is local (AV:L), low complexity (AC:L), low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by a local process or user already on the machine, not over the network. No authentication beyond an existing local session is needed.

Exploitation

CVE-2023-36036 was added to CISA KEV on 2023-11-14 with a remediation due date of 2023-12-05, confirming active exploitation. EPSS gives a 30-day probability of 0.1667 (96.9th percentile), and the only references are the Microsoft patch advisory and the CISA KEV entry; no public exploit code or ransomware association is documented in this record.

What to do

• Apply the Microsoft security update for CVE-2023-36036 to all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• If patching cannot be completed immediately, follow the vendor mitigation guidance or discontinue use of the affected product per the CISA KEV required action.
• Restrict local interactive logon and limit who can run code on endpoints and servers to reduce the pool of users who can trigger the driver.
• Monitor for and block untrusted drivers or processes interacting with the Cloud Files mini filter where feasible.
• Track the CISA KEV due date of 2023-12-05 and verify remediation across the full affected product list.

Detection

• Alert on unexpected processes loading or interacting with the Cloud Files mini filter driver (cldflt) outside normal cloud sync activity.
• Monitor for privilege escalation from a non-system process to SYSTEM, especially via driver-related crash or memory corruption events.
• Correlate local process creation with subsequent SYSTEM-level actions such as service creation, credential access or defense evasion.
• Review Windows event logs and EDR telemetry for anomalous driver load or handle activity on hosts running affected Windows builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.