MiniPlasma: A Five-Year-Old Windows Zero-Day Resurfaces With Working PoC, Granting SYSTEM Privileges on Fully Patched Systems

Overview

A security researcher operating under the handle Chaotic Eclipse — whose GitHub profile uses the name Nightmare-Eclipse — published a working proof-of-concept exploit on May 13, 2026, targeting a privilege escalation flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The vulnerability, dubbed MiniPlasma, allows a standard user account to obtain SYSTEM-level privileges on fully patched Windows 11 systems, including machines updated through the May 2026 Patch Tuesday cycle. No patch exists as of this writing.

What We Know

The flaw originates in the HsmOsBlockPlaceholderAccess routine of cldflt.sys, the driver that underpins Windows cloud storage synchronization services including OneDrive. The root cause, as identified by CyberSecurityNews, is a missing security flag: the OBJ_FORCE_ACCESS_CHECK attribute is not specified during registry key creation in that routine. The exploit works by triggering a race condition that toggles between user and anonymous tokens to manipulate the RtlOpenCurrentUser function, ultimately allowing arbitrary registry keys to be created in the .DEFAULT user hive without proper access checks, enabling the privilege escalation. The technique abuses an undocumented CfAbortHydration API.

BleepingComputer independently tested the exploit on a fully patched Windows 11 Pro system and confirmed it “opened a command prompt with SYSTEM privileges.” Independent security analyst Will Dormann corroborated the finding, confirming “the exploit works reliably on Windows 11 systems running the May 2026 cumulative updates, producing a cmd.exe prompt with full SYSTEM privileges,” while also noting it does not work on the latest Windows 11 Insider Preview Canary build. The exploit is described as working reliably on multi-core systems.

The underlying vulnerability is not new. Google Project Zero researcher James Forshaw originally reported it to Microsoft in September 2020, and it was assigned CVE-2020-17103 with a reported fix shipped in December 2020. Chaotic Eclipse, however, found that the original Project Zero proof-of-concept code worked without modification on current systems, leading the researcher to state: “After investigating, it turns out the exact same issue that was reported to Microsoft by Google project zero is still present, unpatched.” The researcher questioned whether “Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons.”

The GitHub repository accumulated more than 390 stars within days of the release, per CyberSecurityNews. Threat detection firm ThreatLocker identified two registry key paths as indicators of exploitation attempts: \Registry\User\Software\Policies\Microsoft\CloudFiles\BlockedApps* and \Registry\User\.DEFAULT\Volatile Environment*, according to BleepingComputer.

This disclosure is the sixth in a campaign by Chaotic Eclipse spanning approximately six weeks. Previous releases include BlueHammer (CVE-2026-33825), a local privilege escalation flaw that was patched in Microsoft’s April 2026 Patch Tuesday; RedSun, which Microsoft allegedly patched silently without assigning a CVE; UnDefend, a Windows Defender denial-of-service tool; YellowKey, a BitLocker bypass affecting Windows 11 and Server 2022/2025; and GreenPlasma, released in May 2026. The researcher has stated publicly that the disclosures constitute a “protest of Microsoft’s bug bounty and vulnerability-handling process,” alleging the company “mopped the floor with me and pulled every childish game they could.”

The cldflt.sys component has attracted prior exploitation interest. A separate privilege escalation flaw in the same driver, CVE-2025-62221 (CVSS 7.8), was patched by Microsoft in December 2025 after being identified as exploited by unknown threat actors.

What We Don’t Know

Microsoft has not publicly acknowledged MiniPlasma or provided a timeline for a fix. Per Notebookcheck, the company has not commented on the disclosure, though it has previously stated it “supports coordinated vulnerability disclosure” as industry practice. It is not known whether the original December 2020 patch for CVE-2020-17103 was never fully effective or whether a subsequent update regressed it. No threat actors have been publicly linked to active exploitation of MiniPlasma specifically, and it is not known whether any are leveraging the published PoC. The breadth of affected Windows versions beyond Windows 11 has not been independently confirmed, though researchers assess that “all Windows versions are likely affected” given the driver’s presence across the product line.

Analysis

MiniPlasma illustrates a growing pattern of researchers releasing working exploits for unpatched Windows vulnerabilities — sometimes deliberately, as leverage or protest. When a vulnerability requires only local access and grants SYSTEM privileges, its value as a post-exploitation tool is high: an attacker who has already gained a foothold on a machine through phishing, a web exploit, or a supply-chain compromise can use it to complete a full takeover. The reliability of the exploit on standard multi-core hardware makes it operationally attractive.

The broader Chaotic Eclipse campaign — six published exploits in six weeks, several targeting components that had either never been patched or had regressions — raises questions about the durability of Microsoft’s patch verification processes, particularly for driver-level components where regression testing may be less systematic. The December 2025 in-the-wild exploitation of CVE-2025-62221 in the same driver suggests the cldflt.sys attack surface is already on threat actors’ radar.

Until a patch is available, defenders relying on Windows cloud sync features have limited options beyond monitoring the ThreatLocker-identified registry key paths as a detection signal, and reviewing privilege boundaries that could limit the blast radius of a successful escalation.