CVE-2020-17103 – High‑Severity Windows Cloud Files Mini Filter Driver Elevation of Privilege (MiniPlasma)

Key takeaways

• Severity: High (CVSS 7.8)
• Impact: Local privilege escalation to SYSTEM via a race condition in cldflt.sys
• Affected: Windows 10 (1803‑20H2), Windows Server 2016/2019 (all supported builds); Windows 11/Server 2025 appear unpatched
• Status: Patched in 2020, but recent evidence shows the fix is missing or ineffective on newer builds; active exploitation observed in May 2026
• Action: Deploy the latest Microsoft patch, monitor for MiniPlasma activity, and enforce strict least‑privilege controls

Overview

CVE-2020-17103 is a vulnerability in the Windows Cloud Files Mini Filter driver (cldflt.sys). The driver mediates placeholder handling for cloud‑synced files (OneDrive, SharePoint, etc.). A race condition in the driver allows a low‑privileged local user to bypass security checks and execute code in kernel mode, resulting in a SYSTEM‑level shell.

Microsoft released a security update in 2020 that addressed the flaw. In May 2026, the threat‑research group Nightmare Eclipse (aka Chaotic Eclipse) published a proof‑of‑concept exploit named MiniPlasma that demonstrates the vulnerability on fully patched Windows 11 and Server 2025 systems, suggesting that the original fix was not applied to those builds or has regressed.

Technical Details

• Vulnerable component: cldflt.sys – Windows Cloud Files Mini Filter driver (also referenced as the Cloud Filter HsmOsBlockPlaceholderAccess driver).
• Root cause: A race condition when the driver processes placeholder creation and deletion. By rapidly opening and closing handles, an attacker can cause the driver to reference uninitialized memory, leading to arbitrary kernel code execution.
• Exploit flow (MiniPlasma PoC):
  1. Acquire a handle to the driver as a standard user.
  2. Trigger the race by repeatedly creating and deleting cloud‑file placeholders.
  3. Corrupt the driver’s internal state, causing it to execute attacker‑controlled shellcode.
  4. Spawn a SYSTEM shell.
• Requirements: Local user account; no special privileges or user interaction. The attack works on both 32‑bit and 64‑bit builds.
• Proof‑of‑Concept: Publicly released on GitHub by Nightmare Eclipse (see References). The PoC has been observed to work on Windows 11 and Server 2025 despite the presence of the 2020 patch.

Severity & Impact

The CVSS vector reflects a local attack with low complexity and high impact across confidentiality, integrity, and availability. Recent threat‑intel signals show active exploitation (two reported incidents on 2026‑05‑16 and 2026‑05‑18) and a surge of PoC releases, indicating that adversaries are actively weaponizing this flaw.

Affected Products

• Windows 10 – versions 1803, 1809, 1903, 1909, 2004, 20H2
• Windows Server 2016 – all supported builds
• Windows Server 2019 – all supported builds

Note: Evidence suggests Windows 11 and Server 2025 are also vulnerable because the original fix was not back‑ported. For the exhaustive list of affected versions, see the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2020-17103.

Actionable Insights

• Patch verification: Confirm that the latest cumulative update for your OS includes the fix for CVE-2020-17103. Use Windows Update or WSUS to verify the KB number referenced in Microsoft’s advisory.
• Monitor for MiniPlasma indicators:
  • Unexpected loads of cldflt.sys (Sysmon Event ID 7) from unknown binaries.
  • Creation of a SYSTEM‑owned process from a non‑admin user (Sysmon Event ID 10).
  • Presence of the MiniPlasma executable or related scripts in temporary directories.
• Temporary mitigation (if patch unavailable):
  • Disable the driver: sc stop cldflt and sc config cldflt start= disabled.
  • Restrict access to cloud‑sync folders (OneDrive, SharePoint) for non‑admin accounts.
• Hardening: Enforce least‑privilege policies, disable local admin rights where possible, enable Credential Guard, and use Application Control (AppLocker or WDAC) to block unsigned drivers.
• Threat intel feed: Subscribe to VulnSocial’s real‑time feed for this CVE to receive alerts on new exploit activity: https://vulnsocial.com/cve/CVE-2020-17103.

Remediation & Mitigation

1. Identify OS version – Run winver or systeminfo to confirm the Windows build.
2. Check patch level – Use wmic qfe list brief /format:table | findstr /i "2020-17103" or review installed updates in Settings > Update & Security.
3. Deploy the latest cumulative update that contains the patch for CVE-2020-17103. For Windows 10, this is included in the August 2020 Patch Tuesday and later updates. For Windows 11/Server 2025, apply any out‑of‑band security update released after May 2026 (monitor Microsoft advisory).
4. If no patch is available, temporarily disable the driver:

   sc stop cldflt
   sc config cldflt start= disabled
   

5. Implement detection rules – Add Sysmon configuration to log driver loads and create alerts for cldflt.sys load events or SYSTEM shells spawned by non‑admin users.
6. Enforce least‑privilege – Remove local admin rights from standard users, enable Credential Guard, and restrict cloud‑sync client usage where possible.
7. Stay informed – Follow the VulnSocial CVE page for updates on new PoCs or patches.

Bottom Line

CVE-2020-17103 remains a high‑severity local privilege escalation risk. Although Microsoft issued a fix in 2020, recent evidence shows the vulnerability persists on newer Windows releases and is being actively exploited via the MiniPlasma PoC. Immediate actions: verify patch deployment, consider temporary driver disablement on unpatched systems, and monitor for exploitation indicators.

References

• Microsoft Security Update Guide – https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17103
• Microsoft Security Advisory – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17103
• VulnSocial CVE details – https://vulnsocial.com/cve/CVE-2020-17103

#CVE2020-17103 #High #Windows #LPE #MiniPlasma #Microsoft #Patch #ActiveExploitation