Mini Plasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems
Summary: Security researcher Chaotic Eclipse released a proof-of-concept for MiniPlasma, a Windows privilege escalation zero-day in the Cloud Files Mini Filter Driver (cldflt.sys) that grants SYSTEM privileges on fully patched systems. The flaw was reported to Microsoft by Google Project Zero's James Forshaw in September 2020 and assumed fixed in December 2020 as CVE-2020-17103, but Chaotic Eclipse says the same issue remains unpatched and that Forshaw's original PoC worked without changes.
What you should know: Researcher Will Dormann reports the exploit opens a SYSTEM shell reliably on Windows 11 systems running the latest May 2026 updates, meaning a fix Microsoft recorded more than five years ago may never have held - and the same driver already carried CVE-2025-62221, which Microsoft said was exploited in the wild.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-17103CVE-2025-62221
- Related
- CVE-2025-62221: Microsoft Windows Use After Free Vulnerability Known Exploited Vulnerabilities · Dec 09, 2025