A Windows privilege escalation flaw called "MiniPlasma" has surfaced with public exploit code on GitHub, published May 13, 2026 — one day after May's Patch Tuesday. Researcher Nightmare-Eclipse says Microsoft never properly fixed a bug James Forshaw of Google Project Zero reported in September 2020 and Microsoft closed that December.
There's no new CVE: it still tracks under the 2020 one, CVE-2020-17103, rated 7.8 High by NVD and 7.0 by Microsoft. The flaw is in the Cloud Files Mini Filter driver (cldflt.sys), where a missing access check lets a standard user win a race to create registry keys in the .DEFAULT hive and take SYSTEM on fully patched machines.
The researcher reports it working on every Windows version he tested, and it's confirmed on Windows 11 with the May 2026 updates — but it fails on the latest Windows 11 Insider Preview Canary build, and because it's a race condition, reliability varies. Since cldflt underpins OneDrive and other cloud storage, the vulnerable code sits on most Windows installs.
The repository passed 390 stars within days. Until Microsoft ships a fix, application control and EDR monitoring of the affected registry keys are the only containment available — neither closes the hole.
Updated August 13, 2026: Microsoft patched MiniPlasma on June 9, 2026 in its June Patch Tuesday — still under CVE-2020-17103, six years after first closing it. If you haven't applied it, watch for symbolic links created under HKU.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps.
Source: Cybersecurity News
