# MiniPlasma: Unpatched Windows Kernel Flaw Grants SYSTEM Access Six Years After Supposed Fix


## The Threat


A critical Windows privilege escalation zero-day designated MiniPlasma has resurfaced with active proof-of-concept code, enabling attackers to escalate privileges to SYSTEM level on fully patched Windows systems. The vulnerability resides in cldflt.sys, the Windows Cloud Files Mini Filter Driver, within a routine called HsmOsBlockPlaceholderAccess. Most concerning: this is not a new flaw. Security researchers have confirmed it is the exact same vulnerability that Microsoft claimed to patch in December 2020 as CVE-2020-17103.


The disclosure comes from Chaotic Eclipse, a security researcher known for uncovering high-impact Windows flaws including YellowKey and GreenPlasma. In a detailed analysis, Chaotic Eclipse revealed that Google Project Zero researcher James Forshaw originally reported the vulnerability to Microsoft in September 2020, with Microsoft's patching efforts apparently failing to resolve the underlying issue. The researcher weaponized the original proof-of-concept code—which required no modifications—to demonstrate reliable SYSTEM shell spawning on current Windows systems.


The implications are severe. This means organizations running the latest Windows security updates face an unpatchable privilege escalation vector. The vulnerability operates at the kernel level, allowing attackers with limited code execution capabilities to jump directly to the highest privilege level, bypassing modern defense-in-depth strategies. Will Dormann, an independent security researcher, confirmed the exploit works "reliably" on Windows 11 systems running May 2026 updates—Microsoft's most current release at time of disclosure.


## Severity and Impact


| Identifier | Value |

|---|---|

| CVE | CVE-2020-17103 (original) / MiniPlasma (active 0-day) |

| CVSS Score | 7.8–9.0 (estimated; related CVE-2025-62221 scores 7.8) |

| Attack Vector | Local |

| Attack Complexity | Medium (race condition-dependent) |

| Privileges Required | Low (user-level code execution) |

| User Interaction | Not required |

| Scope | Changed (kernel context) |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |

| CWE | CWE-269 (Improper Access Control to Privileged Functionality) |


The vulnerability carries near-critical severity. Once an attacker gains initial code execution on a Windows system—through malware, supply chain attack, or social engineering—MiniPlasma provides an instant path to SYSTEM privileges. From this position, attackers can disable antivirus software, install persistent rootkits, exfiltrate data, and achieve complete system compromise.


## Affected Products


  • Windows 10 (all versions)
  • Windows 11 (all versions, including May 2026 patches)
  • Windows Server 2016 and later
  • All Windows versions are likely affected, per researcher assessment

    • Not affected: Windows 11 Insider Preview Canary (latest development build) reportedly resists the exploit, suggesting a patch may exist in future releases.


    ## Mitigations


    Until Microsoft releases a verified patch, organizations should implement the following controls:


    Immediate actions:

  • Disable Cloud Files Filter Driver if not in active use: Run fsutil behavior query DisableDeleteNotify and disable cldflt.sys via Device Manager if possible in your environment
  • Implement process monitoring for suspicious spawning of cmd.exe, PowerShell, or system processes with SYSTEM privileges from user-level applications
  • Restrict user-level code execution by enforcing application allowlisting and disabling script execution where feasible
  • Monitor for PoC exploitation attempts on internal systems and network edges

    • Defensive posture improvements:

  • Network segmentation to limit lateral movement from compromised user accounts
  • Credential Guard and Virtualization-Based Security (VBS) to contain privilege escalation impact
  • Audit privileged account activity for anomalous access patterns
  • Endpoint Detection and Response (EDR) tuned to flag kernel-level privilege escalation attempts
  • Regular testing of incident response procedures for SYSTEM-level compromise scenarios

    • Longer-term:

  • Await Microsoft's release of a verified patch; do not apply preliminary or partial updates without confirmation
  • Consider migration to Windows 11 Canary branch if compatibility permits (though this is not a production-supported pathway)

    • ## References


  • [Google Project Zero Vulnerability Disclosure (CVE-2020-17103)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17103)
  • [Microsoft Security Update December 2020](https://support.microsoft.com/en-us/help/4592437)
  • [CVE-2025-62221: Related Cloud Files Driver Flaw](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62221)
  • [Chaotic Eclipse Disclosure (Mastodon/Research Community)](https://chaos.social/)

    • ---


    ## HackWire Analysis


    The Pattern: Microsoft's Patch Problem Gets Worse


    MiniPlasma is more than a technical oversight—it's a symptom of a broader crisis in Windows patch quality. For six years, this vulnerability has sat in plain sight. Microsoft either failed to patch it correctly, or worse, silently rolled back a patch at some point, a possibility Chaotic Eclipse raised openly. Either scenario is damning.


    The research community has long debated whether Windows patches are truly fixing issues or merely shuffling them around. MiniPlasma provides evidence for the pessimistic view. The original Google Project Zero PoC from 2020 works without modification. That's not a patch regression—it's no patch at all.


    What makes this especially dangerous is the target audience's false confidence. IT teams running "fully patched" systems believe they've mitigated kernel-level threats. MiniPlasma shatters that assumption. The vulnerability requires only low-privilege code execution to reach SYSTEM level—a threshold most networks cross hundreds of times daily via browser downloads, email attachments, and third-party software updates.


    The CVE-2025-62221 precedent is instructive. That related vulnerability in the same driver was already being exploited by unknown threat actors before public disclosure. It's entirely plausible that MiniPlasma has been in active use by sophisticated attackers for months or years while organizations checked their patch status and moved on.


    For defenders, this is a wake-up call: assume Microsoft's patch timeline is optimistic. Implement runtime detection of kernel-level escalation attempts. For security teams managing Windows fleets, MiniPlasma makes a strong case for aggressive adoption of Virtualization-Based Security and credential guard, which can contain the fallout even if privilege escalation succeeds. For incident response, treat any SYSTEM shell spawning from user-level processes as a confirmed breach, not a suspicious alert.


    The fact that Windows Insider Preview Canary reportedly isn't vulnerable hints that a fix exists—it's just not in production yet. The question Microsoft needs to answer is not whether they can patch this, but why it took six years to try.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)