MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems

A critical Windows privilege escalation zero-day vulnerability named MiniPlasma affects the Cloud Files Mini Filter Driver (cldflt.sys) and allows attackers to gain SYSTEM privileges on fully patched Windows systems.

• •The vulnerability exists in the HsmOsBlockPlaceholderAccess routine and was originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020
• •Microsoft's patch for the issue (CVE-2020-17103) in December 2020 appears ineffective, as the exact same vulnerability remains unpatched according to researcher Chaotic Eclipse
• •A working proof-of-concept exploit has been released that reliably spawns a SYSTEM shell, though success may vary due to the race condition nature of the exploit
• •The vulnerability affects all Windows versions and has been confirmed working on Windows 11 systems with May 2026 updates