{"id":"CVE-2026-112810","kind":"vulnerability","aliases":["CVE-2026-112810"],"related":[],"title":"Windows Cloud Files Mini Filter Driver race lets local user gain privileges","description":"Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"Race condition (TOCTOU) in the Windows Cloud Files Mini Filter Driver lets a local low-privilege user elevate privileges. Microsoft rates exploitation less likely; no exploitation or public disclosure is reported. Attack complexity is high. Affected builds and the fixing update are not yet confirmed.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-files-mini-filter-driver","infrastructure","local-privilege-escalation","onedrive","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Microsoft has not given affected builds in the pages read. Check the MSRC Security Update Guide entry for CVE-2026-112810 for your Windows build, then confirm the latest cumulative update is installed (winver, or Get-HotFix).","fix":null,"status":"open","published_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","triaged_at":"2026-11-10T19:53:34+00:00","updated_at":"2026-11-11T00:03:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Cloud Files Mini Filter Driver race lets local user gain privileges","impact":"high","summary":"A race condition (time-of-check time-of-use) in the Windows Cloud Files Mini Filter Driver lets an authorized local user elevate their privileges. An attacker who already has a foothold on the machine can gain higher system rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","cloud-files-mini-filter-driver","onedrive"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-112810 for affected Windows builds, the fixed cumulative update, and whether a non-default feature is required.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Windows machines with the Cloud Files Mini Filter Driver present, which is the component behind OneDrive and other sync-root features. An attacker needs a local account on the machine, so shared hosts and multi-user systems carry the most risk. unknown whether default installs are exposed beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4517,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-112810 for affected Windows builds, the fixed cumulative update, and whether a non-default feature is required.","search":"'-112810':15A,18A '-2026':14A,17A 'affect':68B 'allow':96C 'attack':64B,99C 'author':98C 'build':69B 'check':81C 'cloud':2A,20B,38B,91C 'cloud-files-mini-filter-driv':19B 'complex':65B 'condit':33B,88C 'confirm':77B 'cve':13A,16A 'disclosur':61B 'driver':6A,24B,42B,95C 'elev':50B,101C 'escal':29B 'exploit':54B,58B 'file':3A,21B,39B,92C 'filter':5A,23B,41B,94C 'fix':72B 'gain':11A 'high':67B 'infrastructur':25B 'less':55B 'let':8A,43B 'like':56B 'local':9A,27B,45B,103C 'local-privilege-escal':26B 'low':47B 'low-privileg':46B 'microsoft':52B 'mini':4A,22B,40B,93C 'onedr':30B 'privileg':12A,28B,48B,51B,102C 'public':60B 'race':7A,32B,87C 'rate':53B 'report':63B 'time':79C,83C 'time-of-check':78C 'time-of-us':82C 'toctou':34B,86C 'updat':73B 'use':85C 'user':10A,49B 'window':1A,31B,37B,90C 'yet':76B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the Cloud Files Mini Filter Driver (the component behind OneDrive and other sync-root features). An attacker needs a local low-privilege account and must win a race, so shared hosts, RDS/VDI and multi-user systems carry the most risk. Single-user machines with no untrusted local code can lower priority; exact affected builds are not yet confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudfilesminifilterdriver","high","infrastructure","localprivilegeescalation","onedrive","windows"],"campaign_type":null,"search_a":"'-112810':15A,18A '-2026':14A,17A 'cloud':2A 'cve':13A,16A 'driver':6A 'file':3A 'filter':5A 'gain':11A 'let':8A 'local':9A 'mini':4A 'privileg':12A 'race':7A 'user':10A 'window':1A","search_b":"'affect':68B 'attack':64B 'build':69B 'cloud':20B,38B 'cloud-files-mini-filter-driv':19B 'complex':65B 'condit':33B 'confirm':77B 'disclosur':61B 'driver':24B,42B 'elev':50B 'escal':29B 'exploit':54B,58B 'file':21B,39B 'filter':23B,41B 'fix':72B 'high':67B 'infrastructur':25B 'less':55B 'let':43B 'like':56B 'local':27B,45B 'local-privilege-escal':26B 'low':47B 'low-privileg':46B 'microsoft':52B 'mini':22B,40B 'onedr':30B 'privileg':28B,48B,51B 'public':60B 'race':32B 'rate':53B 'report':63B 'toctou':34B 'updat':73B 'user':49B 'window':31B,37B 'yet':76B","search_c":"'allow':96C 'attack':99C 'author':98C 'check':81C 'cloud':91C 'condit':88C 'driver':95C 'elev':101C 'file':92C 'filter':94C 'local':103C 'mini':93C 'privileg':102C 'race':87C 'time':79C,83C 'time-of-check':78C 'time-of-us':82C 'toctou':86C 'use':85C 'window':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112810","severity":null,"published_at":"2026-11-10T19:18:45+00:00","modified_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","fetched_at":"2026-11-10T19:24:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112810:3279","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-112810","severity":null,"published_at":"2026-11-11T00:03:39+00:00","modified_at":"2026-11-11T00:03:39+00:00","first_seen_at":"2026-11-11T00:03:39+00:00","fetched_at":"2026-11-11T00:03:39+00:00","note":"MSRC SUG API entry read (rendered page JS-only, so no builds/KB retrieved): not exploited, not public, Exploitation Less Likely, AC:H race, can create files in protected Windows dirs. Affected builds and fixed KB unknown; settle via MSRC page in a browser or the monthly CVRF. Nothing verified. X/search not tried.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-112810"]}],"documents":[{"id":120511,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-112810","title":"MSRC Security Update Guide: CVE-2026-112810","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC entry: Windows Cloud Files Mini Filter Driver TOCTOU race, local elevation of privilege. CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), temporal 6.1. Exploitation Less Likely. Not exploited, not publicly disclosed. Impact: attacker could create files in protected Windows directories. No affected builds or KB listed in the retrieved content.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}