{"id":"CVE-2026-119974","kind":"vulnerability","aliases":["CVE-2026-119974"],"related":[],"title":"Windows Cloud Files Mini Filter Driver: race condition lets local users gain privileges","description":"Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"A time-of-check time-of-use race condition in the Windows Cloud Files Mini Filter Driver lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher rights on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-files","infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:22+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","triaged_at":"2026-11-10T19:51:23+00:00","updated_at":"2026-11-10T19:51:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Cloud Files Mini Filter Driver: race condition lets local users gain privileges","impact":"high","summary":"A time-of-check time-of-use race condition in the Windows Cloud Files Mini Filter Driver lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher rights on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","cloud-files","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119974 for affected Windows builds and the fixed KB or update.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine running the Cloud Files Mini Filter Driver, which is the component behind cloud sync features such as OneDrive placeholder files, is in scope. Exposure requires an attacker who already has a local account on the system. Systems without the driver loaded or with no untrusted local users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4517,"output_tokens":490,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119974 for affected Windows builds and the fixed KB or update.","search":"'-119974':16A,19A '-2026':15A,18A 'account':63B 'allow':89C 'alreadi':59B 'attack':57B,92C 'author':50B,91C 'check':33B,74C 'cloud':2A,21B,43B,84C 'cloud-fil':20B 'condit':8A,39B,81C 'cve':14A,17A 'driver':6A,47B,88C 'elev':53B,94C 'escal':27B 'file':3A,22B,44B,85C 'filter':5A,46B,87C 'gain':12A,65B 'higher':66B 'infrastructur':23B 'let':9A,48B 'local':10A,25B,51B,62B,96C 'local-privilege-escal':24B 'machin':70B 'mini':4A,45B,86C 'privileg':13A,26B,55B,95C 'race':7A,38B,80C 'right':67B 'time':31B,35B,72C,76C 'time-of-check':30B,71C 'time-of-us':34B,75C 'toctou':79C 'use':37B,78C 'user':11A,52B 'window':1A,28B,42B,83C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine running the Cloud Files Mini Filter Driver, which is the component behind cloud sync features such as OneDrive placeholder files, is in scope. Exposure requires an attacker who already has a local account on the system. Systems without the driver loaded or with no untrusted local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudfiles","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-119974':16A,19A '-2026':15A,18A 'cloud':2A 'condit':8A 'cve':14A,17A 'driver':6A 'file':3A 'filter':5A 'gain':12A 'let':9A 'local':10A 'mini':4A 'privileg':13A 'race':7A 'user':11A 'window':1A","search_b":"'account':63B 'alreadi':59B 'attack':57B 'author':50B 'check':33B 'cloud':21B,43B 'cloud-fil':20B 'condit':39B 'driver':47B 'elev':53B 'escal':27B 'file':22B,44B 'filter':46B 'gain':65B 'higher':66B 'infrastructur':23B 'let':48B 'local':25B,51B,62B 'local-privilege-escal':24B 'machin':70B 'mini':45B 'privileg':26B,55B 'race':38B 'right':67B 'time':31B,35B 'time-of-check':30B 'time-of-us':34B 'use':37B 'user':52B 'window':28B,42B","search_c":"'allow':89C 'attack':92C 'author':91C 'check':74C 'cloud':84C 'condit':81C 'driver':88C 'elev':94C 'file':85C 'filter':87C 'local':96C 'mini':86C 'privileg':95C 'race':80C 'time':72C,76C 'time-of-check':71C 'time-of-us':75C 'toctou':79C 'use':78C 'window':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119974","severity":null,"published_at":"2026-11-10T19:20:22+00:00","modified_at":"2026-11-10T19:20:22+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","fetched_at":"2026-11-10T19:25:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}