TALOS-2026-2445
CVE-2026-80093
A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver (version(s): 10.0.26100.8457 (WinBuild.160101.0800) and 10.0.26100.8655 (WinBuild.160101.0800)). A specially crafted sequence of Cloud Filter API calls can lead to type confusion. An attacker can execute a dedicated application to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Windows Cloud Files Mini Filter Driver (version(s): 10.0.26100.8457 (WinBuild.160101.0800) and 10.0.26100.8655 (WinBuild.160101.0800))
Windows Cloud Files Mini Filter Driver - https://www.microsoft.com/
8.8 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-843 - Access of Resource Using Incompatible Type (‘Type Confusion’)
The Cloud Files Mini-Filter Driver (cldflt.sys) is a Microsoft Windows kernel-mode filesystem driver that enables cloud storage integration features such as OneDrive Files On-Demand. It manages cloud-based placeholder files, synchronizes data between local storage and cloud services, and downloads files automatically when users access them. The driver operates within the Windows file system stack to make cloud files behave like regular local files.
The vulnerable condition is reached when one thread walks OpenStream->RequestListHead in CldStreamAbortOperation while another thread, executing CldiStreamProcessPendingHydrationRequests, has temporarily inserted a stack-based LIST_ENTRY sentinel into the same intrusive request list. The abort walker assumes every list entry is embedded inside a CLD_STREAM_REQUEST_PARTIAL object at offset +0x8. If it sees the stack sentinel, it computes:
request = CONTAINING_RECORD(entry,
CLD_STREAM_REQUEST_PARTIAL,
OpenStreamListEntry);
which is equivalent to:
request = (CLD_STREAM_REQUEST_PARTIAL *)((char *)entry - 0x8);
For a sentinel entry, this produces a fake request object backed by another thread’s kernel stack. Later code dereferences fields from this fake request and writes through a fake QueueContext pointer, causing a kernel crash and potentially providing a write primitive if the fake request fields can be influenced.
To trigger this condition, an attacker must register a provider and create a dehydrated placeholder.
Next, an attempt to read from that placeholder triggers the OnFetchData callback. If the provider does not respond to this fetch-data request, the kernel creates a pending request associated with that placeholder and stream.
While that request is pending, the attacker can call one of the undocumented APIs: CfAbortOperation.
It sends a message to the cldflt driver through the \\CLDMSGPORT communication port, triggering the CldiPortProcessAbortHydration (0x4002) handler on the kernel side.
As its name suggests, this handler is responsible for operation and hydration cancellation. In a normal scenario, a provider or client calling this function attempts to cancel specific request(s) associated with a particular connection or sync root.
However, we can use wildcard-like values for the relevant fields and call CfAbortOperation in the following way:
/*
HRESULT CfAbortOperation(DWORD ProviderProcessId, CF_ABORT_PARAMS *pAbortParams, DWORD Flags)
struct CF_ABORT_PARAMS { // size: 0x20 (32 bytes)
__int64 ProviderKey; // +0x00
__int64 SyncRootKey; // +0x08
__int64 StreamKey; // +0x10
__int64 RequestKey; // +0x18
};
*/
HRESULT hr = pfnAbort(0, NULL, 0);
This leads to a scenario where CldiPortProcessAbortHydration and its callees iterate over all connections, sync roots, stream tables, streams, and their corresponding requests in order to abort them.
Looking at the call stack during the crash, we can see the following function calls:
For ProviderProcessId = 0, ProviderKey = 0 , SyncRootKey = 0 , StreamKey = 0 ,RequestKey = 0
� CldiPortNotifyMessage
� CldiPortProcessFilterControl
� CldiPortProcessAbortHydration - Iterates over Connections and related RootSync
� CldSyncAbortOperation - Iterates over StreamsTable for particular RootSync
� CldStreamAbortOperation - Iterates over StreamRequests for particular stream
� CldiStreamPrepareRequestForNonCdqCompletion
� CldiStreamPrepareRequestForMoreProcessing Keep in mind that when the abort procedure is called this way, it repeatedly walks all of these lists while trying to abort pending requests.
Let us focus on CldStreamAbortOperation:
Line 1 void __fastcall CldStreamAbortOperation(int ProcessId, PCLD_OPEN_STREAM_PARTIAL OpenStream, PVOID RequestKey)
Line 2 {
Line 3 currentSessionId = HsmOsGetProcessSessionIdFromEproccess(currentProcess);
Line 4 ...
Line 5
Line 6
Line 7 requestListHead = &OpenStream->RequestListHead;
Line 8 LABEL_9:
Line 9 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v10);
Line 10 for ( entry = requestListHead->Flink; entry != requestListHead; entry = *v16 )
Line 11 {
Line 12 request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
Line 13 if ( HsmOsIsInSameSession(ProcessSessionIdFromEproccess, (ULONG)entry[4].Blink, currentSessionId)
Line 14 && request->RequestorProcessId == ProcessId
Line 15 && (!RequestKey || RequestKey == request->RequestKeyOrSequence) )
Line 16 {
Line 17 LOBYTE(v17) = Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1();
Line 18 if ( v17 )
Line 19 {
Line 20 if ( !CldiStreamPrepareRequestForNonCdqCompletion(request) || !CldiCanDoNonCdqCompletion(request) )
Line 21 goto LABEL_18;
Line 22 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
Line 23 }
Line 24 else if ( !CldiStreamPrepareRequestForNonCdqCompletion(request) )
Line 25 {
Line 26 LABEL_18:
Line 27 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
Line 28 goto LABEL_9;
Line 29 }
Line 30 CldiStreamCompleteCanceledRequest(request, 0xC000CF16);
Line 31 goto LABEL_9;
Line 32 }
Line 33 }
Line 34 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v13);
Line 35 }
Inside, we can see the for loop at lines 10-33 iterating over the request list:
Line 7 requestListHead = &OpenStream->RequestListHead;
Importantly, during each loop iteration there is a time window where the lock protecting this list:
Line 9 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v10);
is released:
CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
This has further consequences.
Before any action is performed on the current request, several conditions must be satisfied at lines 13-15.
Starting from the last one:
Line 15 && (!RequestKey || RequestKey == request->RequestKeyOrSequence) )
This is true because we set RequestKey to 0.
For:
Line 14 && request->RequestorProcessId == ProcessId
This condition is difficult to satisfy, because we set ProcessId = 0, so RequestorProcessId is normally not equal to 0.
So how did we pass all three constraints and execute several additional functions?
After CfAbortOperation is invoked, CldiPortProcessAbortHydration runs in a kernel thread and attempts to abort requests by repeatedly iterating over the aforementioned list, while the attacker simultaneously invokes CfDisconnectSyncRoot.
Calling that API causes the following execution sequence:
USER-MODE : CfDisconnectSyncRoot
KERNEL:
� CldiPortNotifyMessage
� CldiPortProcessServiceCommands
� CldSyncDisconnectRootByObject
� CldiSyncTransferOrAckDataByObject
� CldStreamTransferData
� CldiStreamProcessPendingHydrationRequests
Taking a closer look at CldiStreamProcessPendingHydrationRequests, we can see:
Line 400 void __fastcall CldiStreamProcessPendingHydrationRequests(
Line 401 PCLD_OPEN_STREAM_PARTIAL OpenStream,
Line 402 PVOID AcquireContext,
Line 403 int AckDisposition,
Line 404 NTSTATUS CompletionStatus,
Line 405 LONGLONG TransferOffset,
Line 406 LONGLONG TransferLength,
Line 407 LONGLONG TransferBuffer)
Line 408 {
Line 409 LIST_ENTRY *p_RequestListHead; // r14
Line 410 LIST_ENTRY list_sentinel;
Line 411 ...
Line 412 list_sentinel.Blink = &list_sentinel;
Line 413 list_sentinel.Flink = &list_sentinel;
Line 414 p_RequestListHead = &OpenStream->RequestListHead;
Line 415 ...
Line 416 LABEL_2:
Line 417 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, (PKIRQL)AcquireContext);
Line 418 if ( list_sentinel.Flink == &list_sentinel )
Line 419 {
Line 420 Blink = p_RequestListHead->Blink; // Temporarily appends a stack sentinel to the open-stream request list so the walker can restart safely after completion/reschedule mutates the list.
Line 421 if ( Blink->Flink != p_RequestListHead )
Line 422 goto LABEL_54;
Line 423 list_sentinel.Blink = p_RequestListHead->Blink;
Line 424 list_sentinel.Flink = p_RequestListHead;
Line 425 Blink->Flink = &list_sentinel;
Line 426 p_RequestListHead->Blink = &list_sentinel;
Line 427 }
Line 428 Flink = p_RequestListHead->Flink;
Line 429 while ( Flink != p_RequestListHead && Flink != &list_sentinel )
Line 430 {
Line 431 CompletionStatusa = SavedCompletionStatus;
Line 432 Request = CONTAINING_RECORD(Flink, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
(...)
Line 600 if ( v22 )
Line 601 {
Line 602 CldiStreamPrepareRequestForNonCdqCompletion((PCLD_STREAM_REQUEST_PARTIAL)&Flink[-1].Blink);
Line 603 LOBYTE(v24) = Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1();
Line 604 if ( v24 && !CldiCanDoNonCdqCompletion(&Flink[-1].Blink) )
Line 605 LABEL_47:
Line 606 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, HydrationOffset);
Line 607 else
Line 608 CldiStreamCompleteRequest(OpenStream, (PCLD_STREAM_REQUEST_PARTIAL)&Flink[-1].Blink, CompletionStatusa, 0);
Line 609 SavedAckDisposition = v36;
Line 610 SavedCompletionStatus = v37;
Line 611 goto LABEL_2; //restart iteration
Line 612 }
(...)
Line 700 if ( list_sentinel.Flink != &list_sentinel )
Line 701 {
Line 702 v26 = list_sentinel.Blink;
Line 703 if ( list_sentinel.Flink->Blink != &list_sentinel
Line 704 || (HydrationOffset = (LONGLONG)&list_sentinel, list_sentinel.Blink->Flink != &list_sentinel) )
Line 705 {
Line 706 LABEL_54:
Line 707 __fastfail(3u);
Line 708 }
Line 709 list_sentinel.Blink->Flink = list_sentinel.Flink;
Line 710 v25->Blink = v26;
Line 711 list_sentinel.Blink = &list_sentinel;
Line 712 list_sentinel.Flink = &list_sentinel;
Line 713 }
Line 714 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, HydrationOffset);
Line 715 }
The first thing we can notice is that CldiStreamProcessPendingHydrationRequests also iterates over the same request list as CldStreamAbortOperation:
Line 414 p_RequestListHead = &OpenStream->RequestListHead;
We can also notice something specific here that was not present in the previous function: a special element is inserted into OpenStream->RequestListHead. This appears to act as a sentinel for the list lines 418-427.
CldiStreamProcessPendingHydrationRequests walks the open stream pending request list, but while walking it may complete, unlink, reschedule, or otherwise move the current request.
Some of those operations can also release and reacquire the CBDQ lock.
This means the normal iterator state is not stable: the current entry can disappear, its Flink may no longer be safe to use, and new requests may be inserted while the function is still performing a pass.
Therefore, the function inserts a stack LIST_ENTRY sentinel near the tail of OpenStream->RequestListHead. It then walks from the list head until it reaches either the real list head or this temporary sentinel.
Conceptually:
RequestListHead -> req1 -> req2 -> req3 -> sentinel -> head
The sentinel solves three practical problems:
Flink after the current request is completed or moved.However, there is an issue. As shown at line 606, the lock may be released and the while loop may restart at line 611. During this short window, while the lock is released, a thread related to CldStreamAbortOperation can acquire the same lock and iterate over the same list (OpenStream->RequestListHead).
CldStreamAbortOperation is not aware of the LIST_ENTRY list_sentinel object and treats it like any other LIST_ENTRY, attempting to obtain a pointer to a stream request:
Line 12 request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
Since OpenStreamListEntry is at offset 0x8, this produces:
fake_request = sentinel - 0x8
This leads to type confusion because list_sentinel is only a local stack variable, not an OpenStreamListEntry field that is part of a CLD_STREAM_REQUEST_PARTIAL object.
To prove this theory, let us navigate throw crash dump.
0: kd> .cxr 0xffffc60a9218e170 ; kb
rax=01dcf7310e592844 rbx=ffffc60a91c7e908 rcx=00000000c000cf01
rdx=0000000000000000 rsi=ffffa487d6a92f90 rdi=ffffc60a91c7e908
rip=fffff80f76f0a7cf rsp=ffffc60a9218eba0 rbp=0000000000000001
r8=0000000000000001 r9=ffffc60a91c7e910 r10=fffff806e164c190
r11=ffffc60a9218eb98 r12=0000000000000000 r13=0000000000000090
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47:
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax ds:002b:00000000`c000cf29=????????????????
*** Stack trace for last set context - .thread/.cxr resets it
# RetAddr : Args to Child : Call Site
00 fffff80f`76f110d1 : 00000000`00000000 ffffa487`d6a92f80 00000000`00000090 00000000`00000000 : cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
01 fffff80f`76f3f7fb : ffffc60a`91c7e908 fffff806`e2242e80 fffff806`e16d06d0 fffff806`72f42a26 : cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
02 fffff80f`76f3c448 : ffffa487`d6a6efa0 00000000`00000000 ffffa487`d6a9ef88 ffff918f`45df0958 : cldflt!CldStreamAbortOperation+0x123
03 fffff80f`76f3a045 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldSyncAbortOperation+0x108
04 fffff80f`76f7b232 : 00000000`00004002 00000000`00000001 00000001`00000000 ffffa487`bd8b2fd0 : cldflt!CldiPortProcessAbortHydration+0x599
05 fffff80f`76f4af49 : 00000000`00004002 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x76
06 fffff806`72f43622 : ffffa487`d6a42ee0 000000f2`a32ff9a0 00000000`0000016c 000000f2`a32ff960 : cldflt!CldiPortNotifyMessage+0xcc9
07 fffff806`72f8f632 : ffff918f`46e61490 000000f2`a32ff9a0 ffff918f`46e61560 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
08 fffff806`72f4b9c3 : ffff918f`46e61490 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
09 fffff806`e167ccfb : 918f4471`c430fffe 00000000`00060000 ffff918f`4471c460 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
0a fffff806`e167cc73 : ffff918f`4471c460 ffff918f`4471c460 00000000`00000000 ffff918f`45df0958 : nt!IopfCallDriver+0x5b
0b fffff806`e1ceb3a5 : ffff918f`4471c460 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
0c fffff806`e1cea1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
0d fffff806`e1ce983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
0e fffff806`e1adc558 : 00000000`00000001 000000f2`a32fe200 ffffc60a`9218f4e0 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
0f 00007ffa`37901d84 : 00007ffa`2a293bc2 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x28
10 00007ffa`2a293bc2 : 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 00000000`00000060 : ntdll!NtDeviceIoControlFile+0x14
11 00007ffa`2a2931a1 : 00000000`000000c8 00000000`00000000 00000000`000000bc 00000000`00000014 : FLTLIB!FilterpDeviceIoControl+0x13e
12 00007ff6`16c14249 : 000001f6`d43c0000 00000000`00000048 00000000`00000470 00007ffa`377c8771 : FLTLIB!FilterSendMessage+0x31
13 000001f6`d43c0000 : 00000000`00000048 00000000`00000470 00007ffa`377c8771 000001f6`00000040 : abort_type_confusion+0x4249
Line 900 BOOLEAN __fastcall CldiStreamPrepareRequestForMoreProcessing(CLD_STREAM_REQUEST_PARTIAL *Request)
Line 901 {
Line 902 __int64 Now100ns; // rax
Line 903 _QWORD *QueueContext; // rcx
Line 904
Line 905 KeEnterCriticalRegion();
Line 906 ExAcquireResourceExclusiveLite(&g_CrossVmNotificationResource, 1u);
Line 907 Now100ns = MEMORY[0xFFFFF78000000014];
Line 908 QueueContext = Request->QueueContext;
Line 909 Request->PreparedSystemTime100ns = MEMORY[0xFFFFF78000000014];
Line 910 if ( QueueContext )
Line 911 QueueContext[5] = Now100ns; // CRASH!!!
We see an attempt to write the RAX value to the address stored in RCX (00000000c000cf01) plus 0x28, which corresponds to line 911.
00000000c000cf01 looks like the error code STATUS_CLOUD_FILE_PROVIDER_NOT_RUNNING.
QueueContext is a field dereferenced from the fake request object. The pointer to the fake request is in the RBX register. Let us check its location:
0: kd> !address ffffc60a91c7e908
Usage: Stack
Base Address: ffffc60a`91c79000
End Address: ffffc60a`91c80000
Region Size: 00000000`00007000
VA Type: SystemRange
A real request should reside in pool or lookaside memory, not on the stack.
Checking the existing cldflt-related threads in the kernel, we can see:
!stacks 2 cldflt
(...)
[ffff918f4ab240c0 abort_type_confusion.]
6b4.0011bc ffff918f3f2a9080 0000000 Blocked nt!KiSwapContext+0x76
nt!KiSwapThread+0x6d4
nt!KiCommitThreadWait+0x39d
nt!KeWaitForSingleObject+0x859
nt!ExpWaitForResource+0x72
nt!ExAcquireResourceExclusiveLite+0x5e4
cldflt!CldiStreamCdqACQUIRE+0x2a
cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
cldflt!CldStreamTransferData+0x54c
cldflt!CldiSyncTransferOrAckDataByObject+0x487
cldflt!CldSyncDisconnectRootByObject+0x266
cldflt!CldSyncDisconnectRoot+0x136
cldflt!CldiPortProcessServiceCommands+0x1456
cldflt!CldiPortNotifyMessage+0xaba
FLTMGR!FltpFilterMessage+0x162
FLTMGR!FltpMsgDispatch+0xf2
FLTMGR!FltpDispatch+0x133
nt!IopfCallDriver+0x5b
nt!IofCallDriver+0x13
nt!IopSynchronousServiceTail+0x1c5
nt!IopXxxControlFile+0x99c
nt!NtDeviceIoControlFile+0x5e
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtDeviceIoControlFile+0x14
[ffff918f3ba930c0 abort_type_confusion.]
21d8.000850 ffff918f45df0080 0000000 RUNNING nt!DbgBreakPointWithStatus
nt!KiBugCheckDebugBreak+0x12
nt!KeBugCheck2+0xb2e
nt!KeBugCheckEx+0x107
nt!KiBugCheckDispatch+0x69
nt!KiSystemServiceHandler+0x7c
nt!RtlpExecuteHandlerForException+0x12
nt!RtlDispatchException+0x2d2
nt!KiDispatchException+0x35f
nt!KiExceptionDispatch+0x145
nt!KiPageFault+0x442
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
cldflt!CldStreamAbortOperation+0x123
cldflt!CldSyncAbortOperation+0x108
cldflt!CldiPortProcessAbortHydration+0x599
cldflt!CldiPortProcessFilterControl+0x76
cldflt!CldiPortNotifyMessage+0xcc9
FLTMGR!FltpFilterMessage+0x162
FLTMGR!FltpMsgDispatch+0xf2
FLTMGR!FltpDispatch+0x133
nt!IopfCallDriver+0x5b
nt!IofCallDriver+0x13
nt!IopSynchronousServiceTail+0x1c5
nt!IopXxxControlFile+0x99c
nt!NtDeviceIoControlFile+0x5e
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtDeviceIoControlFile+0x14
FLTLIB!FilterpDeviceIoControl+0x13e
FLTLIB!FilterSendMessage+0x31
abort_type_confusion+0x4249
Checking the stack range addresses for the thread created by calling CfDisconnectSyncRoot, we see:
0: kd> !thread ffff918f3f2a9080
THREAD ffff918f3f2a9080 Cid 06b4.11bc Teb: 000000464101e000 Win32Thread: 0000000000000000 WAIT: (WrResource) KernelMode Non-Alertable
ffffc60a91c7e7d8 SynchronizationEvent
IRP List:
ffff918f46531480: (0006,0118) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap ffffa487d64771d0
Owning Process ffff918f4ab240c0 Image: abort_type_confusion.exe
Attached Process N/A Image: N/A
Wait Start TickCount 216903 Ticks: 0
Context Switch Count 70 IdealProcessor: 2
UserTime 00:00:00.015
KernelTime 00:00:00.046
Win32 Start Address abort_type_confusion (0x00007ff616c1615c)
Stack Init ffffc60a91c7f5f0 Current ffffc60a91c7e350
Base ffffc60a91c80000 Limit ffffc60a91c79000 Call 0000000000000000 // < --- IMPORTANT VALUES
Priority 8 BasePriority 8 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffffc60a`91c7e390 fffff806`e169e424 : 00000000`00000047 00000000`00000000 00000000`00000000 ffff8080`43f1e2b0 : nt!KiSwapContext+0x76
ffffc60a`91c7e4d0 fffff806`e1751dcd : 00000000`00000000 00000000`00000000 ffffc60a`91c7e660 fffff80f`00000017 : nt!KiSwapThread+0x6d4
ffffc60a`91c7e560 fffff806`e174ffc9 : ffffa487`00000000 00000000`00000002 00000007`00000017 00000007`e45dcdab : nt!KiCommitThreadWait+0x39d
ffffc60a`91c7e5f0 fffff806`e164d082 : ffffc60a`91c7e7d8 ffff918f`0000001b 00000000`00000000 0000ff00`00000000 : nt!KeWaitForSingleObject+0x859
ffffc60a`91c7e6d0 fffff806`e164c774 : ffff918f`42a84f90 ffffc60a`91c7e7c0 ffff918f`00010224 00000000`00000006 : nt!ExpWaitForResource+0x72
ffffc60a`91c7e760 fffff80f`76f4a06a : 00000000`00000000 00000000`00000004 00000000`00000000 ffffa487`d6a92f90 : nt!ExAcquireResourceExclusiveLite+0x5e4
ffffc60a`91c7e870 fffff80f`76f72c73 : fffff80f`76f86300 ffffa487`c459fe00 ffffa487`d6979870 ffffa487`00000000 : cldflt!CldiStreamCdqACQUIRE+0x2a
ffffc60a`91c7e8a0 fffff80f`76f720d0 : 01dcf731`0e592844 00400000`00046f40 00000000`00000004 00000000`c000cf01 : cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
ffffc60a`91c7e990 fffff80f`76f71afb : ffffa487`d6a92f80 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldStreamTransferData+0x54c
ffffc60a`91c7eac0 fffff80f`76f4c6aa : ffffa487`d6a6efa0 ffffa487`00000000 ffffa487`c000cf01 ffffa487`d6a6efa0 : cldflt!CldiSyncTransferOrAckDataByObject+0x487
ffffc60a`91c7eb80 fffff80f`76f831ea : 00000000`00000000 00000000`00000000 00000209`a10611b0 ffff918f`42a84e80 : cldflt!CldSyncDisconnectRootByObject+0x266
ffffc60a`91c7ebe0 fffff80f`76f82f0e : 00140000`0002a31c 00140000`0002a31c ffffc60a`91c7ecf9 00000000`c0000225 : cldflt!CldSyncDisconnectRoot+0x136
ffffc60a`91c7ec40 fffff80f`76f4ad3a : ffffa487`d6a5aee0 00000000`00000001 00000000`00000005 00000000`000000e8 : cldflt!CldiPortProcessServiceCommands+0x1456
ffffc60a`91c7ed60 fffff806`72f43622 : ffffa487`d6a5aee0 00000209`a1057aa0 00000000`000000e8 00000000`00000000 : cldflt!CldiPortNotifyMessage+0xaba
ffffc60a`91c7ee70 fffff806`72f8f632 : ffff918f`46531480 00000209`a1057aa0 ffff918f`46531550 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
ffffc60a`91c7eee0 fffff806`72f4b9c3 : ffff918f`46531480 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
ffffc60a`91c7ef50 fffff806`e167ccfb : 00000000`00000001 00000000`00060000 ffff918f`4710d230 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
ffffc60a`91c7eff0 fffff806`e167cc73 : ffff918f`4710d230 ffff918f`4710d230 00000000`00000000 ffff918f`3f2a9958 : nt!IopfCallDriver+0x5b
ffffc60a`91c7f030 fffff806`e1ceb3a5 : ffff918f`4710d230 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
ffffc60a`91c7f060 fffff806`e1cea1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffc60a`91c7f110 fffff806`e1ce983e : 00000000`00000000 fffff806`e174ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffc60a`91c7f380 fffff806`e1adc558 : 00000000`0000001c 00000000`00000001 00000046`4101e000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffc60a`91c7f3f0 00007ffa`37901d84 : 00007ffa`2a293bc2 00000000`00000000 00000000`00000000 00007ff6`16c3f158 : nt!KiSystemServiceCopyEnd+0x28 (TrapFrame @ ffffc60a`91c7f460)
00000046`412eed48 00007ffa`2a293bc2 : 00000000`00000000 00000000`00000000 00007ff6`16c3f158 00000000`00000002 : ntdll!NtDeviceIoControlFile+0x14
00000046`412eed50 00007ffa`2a2931a1 : 00000209`a10611b0 0000e2d7`8ef3dbff 00000209`a1057aa0 00000209`a10611b0 : FLTLIB!FilterpDeviceIoControl+0x13e
00000046`412eedc0 00007ffa`208472c2 : 00000209`00000000 00000000`00000000 00000046`412eee89 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
00000046`412eee10 00007ff6`16c13f22 : 00000209`00000000 00000007`e411826b ffffffff`ff676980 00000209`a1069868 : cldapi!CfDisconnectSyncRoot+0x3e2
00000046`412eeef0 00000209`00000000 : 00000007`e411826b ffffffff`ff676980 00000209`a1069868 00000000`00000000 : abort_type_confusion+0x3f22
This confirms that the RBX value points to stack memory associated with this thread. Switching context to that thread:
0: kd> .thread /r /p ffff918f3f2a9080
Implicit thread is now ffff918f`3f2a9080
Implicit process is now ffff918f`4ab240c0
Loading User Symbols
.............
0: kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
# RetAddr : Args to Child : Call Site
00 fffff806`e169e424 : 00000000`00000047 00000000`00000000 00000000`00000000 ffff8080`43f1e2b0 : nt!KiSwapContext+0x76
01 fffff806`e1751dcd : 00000000`00000000 00000000`00000000 ffffc60a`91c7e660 fffff80f`00000017 : nt!KiSwapThread+0x6d4
02 fffff806`e174ffc9 : ffffa487`00000000 00000000`00000002 00000007`00000017 00000007`e45dcdab : nt!KiCommitThreadWait+0x39d
03 fffff806`e164d082 : ffffc60a`91c7e7d8 ffff918f`0000001b 00000000`00000000 0000ff00`00000000 : nt!KeWaitForSingleObject+0x859
04 fffff806`e164c774 : ffff918f`42a84f90 ffffc60a`91c7e7c0 ffff918f`00010224 00000000`00000006 : nt!ExpWaitForResource+0x72
05 fffff80f`76f4a06a : 00000000`00000000 00000000`00000004 00000000`00000000 ffffa487`d6a92f90 : nt!ExAcquireResourceExclusiveLite+0x5e4
06 fffff80f`76f72c73 : fffff80f`76f86300 ffffa487`c459fe00 ffffa487`d6979870 ffffa487`00000000 : cldflt!CldiStreamCdqACQUIRE+0x2a
07 fffff80f`76f720d0 : 01dcf731`0e592844 00400000`00046f40 00000000`00000004 00000000`c000cf01 : cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
08 fffff80f`76f71afb : ffffa487`d6a92f80 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldStreamTransferData+0x54c
09 fffff80f`76f4c6aa : ffffa487`d6a6efa0 ffffa487`00000000 ffffa487`c000cf01 ffffa487`d6a6efa0 : cldflt!CldiSyncTransferOrAckDataByObject+0x487
0a fffff80f`76f831ea : 00000000`00000000 00000000`00000000 00000209`a10611b0 ffff918f`42a84e80 : cldflt!CldSyncDisconnectRootByObject+0x266
0b fffff80f`76f82f0e : 00140000`0002a31c 00140000`0002a31c ffffc60a`91c7ecf9 00000000`c0000225 : cldflt!CldSyncDisconnectRoot+0x136
0c fffff80f`76f4ad3a : ffffa487`d6a5aee0 00000000`00000001 00000000`00000005 00000000`000000e8 : cldflt!CldiPortProcessServiceCommands+0x1456
0d fffff806`72f43622 : ffffa487`d6a5aee0 00000209`a1057aa0 00000000`000000e8 00000000`00000000 : cldflt!CldiPortNotifyMessage+0xaba
0e fffff806`72f8f632 : ffff918f`46531480 00000209`a1057aa0 ffff918f`46531550 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
0f fffff806`72f4b9c3 : ffff918f`46531480 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
10 fffff806`e167ccfb : 00000000`00000001 00000000`00060000 ffff918f`4710d230 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
11 fffff806`e167cc73 : ffff918f`4710d230 ffff918f`4710d230 00000000`00000000 ffff918f`3f2a9958 : nt!IopfCallDriver+0x5b
12 fffff806`e1ceb3a5 : ffff918f`4710d230 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
13 fffff806`e1cea1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
14 fffff806`e1ce983e : 00000000`00000000 fffff806`e174ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
15 fffff806`e1adc558 : 00000000`0000001c 00000000`00000001 00000046`4101e000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
16 00007ffa`37901d84 : 00007ffa`2a293bc2 00000000`00000000 00000000`00000000 00007ff6`16c3f158 : nt!KiSystemServiceCopyEnd+0x28
17 00007ffa`2a293bc2 : 00000000`00000000 00000000`00000000 00007ff6`16c3f158 00000000`00000002 : ntdll!NtDeviceIoControlFile+0x14
18 00007ffa`2a2931a1 : 00000209`a10611b0 0000e2d7`8ef3dbff 00000209`a1057aa0 00000209`a10611b0 : FLTLIB!FilterpDeviceIoControl+0x13e
19 00007ffa`208472c2 : 00000209`00000000 00000000`00000000 00000046`412eee89 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
1a 00007ff6`16c13f22 : 00000209`00000000 00000007`e411826b ffffffff`ff676980 00000209`a1069868 : cldapi!CfDisconnectSyncRoot+0x3e2
1b 00000209`00000000 : 00000007`e411826b ffffffff`ff676980 00000209`a1069868 00000000`00000000 : abort_type_confusion+0x3f22
and changing the frame to:
0: kd> .frame /r 0n7;dv /t /v
07 ffffc60a`91c7e8a0 fffff80f`76f720d0 cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
rax=0000000000000000 rbx=00000000c000cf01 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000004
rip=fffff80f76f72c73 rsp=ffffc60a91c7e8a0 rbp=ffffc60a91c7e941
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=ffffa487d6979878 r13=0000000000000000
r14=ffffa487d6a92f90 r15=ffffa487d6a92f80
iopl=0 nv up di pl nz na po nc
cs=0000 ss=0000 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
cldflt!CldiStreamProcessPendingHydrationRequests+0x6b:
fffff80f`76f72c73 488d45cf lea rax,[rbp-31h]
We can read the sentinel address using the information provided by IDA:
LIST_ENTRY list_sentinel; // [rsp+78h] [rbp-31h] BYREF
0: kd> ?ffffc60a91c7e941-0x31 -8
Evaluate expression: -63726278940408 = ffffc60a`91c7e908
The calculation includes - 8 because:
request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
request = (char *)entry - 0x8;
This is how the CONTAINING_RECORD macro obtains a pointer to the request object in this structure.
With this information, an attacker may attempt to use a different execution path leading to the CldiStreamProcessPendingHydrationRequests call, abusing the resulting type confusion to gain better control over the fields of a fake request object.
This may consequently lead to an arbitrary write and, ultimately, arbitrary code execution.
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80f76f0a7cf, Address of the instruction which caused the BugCheck
Arg3: ffffc60a9218e170, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1765
Key : Analysis.Elapsed.mSec
Value: 3060
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 37
Key : Analysis.IO.Write.Mb
Value: 27
Key : Analysis.Init.CPU.mSec
Value: 42578
Key : Analysis.Init.Elapsed.mSec
Value: 79732706
Key : Analysis.Memory.CommitPeak.Mb
Value: 168
Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002
Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre
Key : Analysis.Version.Ext
Value: 1.2602.27.2
Key : Bugcheck.Code.KiBugCheckData
Value: 0x3b
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Bugcheck.Code.TargetModel
Value: 0x3b
Key : Failure.Bucket
Value: AV_VRF_cldflt!CldiStreamPrepareRequestForMoreProcessing
Key : Failure.Exception.IP.Address
Value: 0xfffff80f76f0a7cf
Key : Failure.Exception.IP.Module
Value: cldflt
Key : Failure.Exception.IP.Offset
Value: 0xa7cf
Key : Failure.Hash
Value: {4129a4d8-43d0-209f-5056-9e4af3e36ca6}
Key : Faulting.IP.Type
Value: Paged
Key : Hypervisor.Enlightenments.ValueHex
Value: 0x6090ebf4
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 1
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 659693
Key : Hypervisor.Flags.ValueHex
Value: 0xa10ed
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 1
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0x0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
Key : WER.System.BIOSRevision
Value: 4.1.0.0
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80f76f0a7cf
BUGCHECK_P3: ffffc60a9218e170
BUGCHECK_P4: 0
FILE_IN_CAB: full.dmp
VIRTUAL_MACHINE: HyperV
FAULTING_THREAD: ffff918f45df0080
CONTEXT: ffffc60a9218e170 -- (.cxr 0xffffc60a9218e170)
rax=01dcf7310e592844 rbx=ffffc60a91c7e908 rcx=00000000c000cf01
rdx=0000000000000000 rsi=ffffa487d6a92f90 rdi=ffffc60a91c7e908
rip=fffff80f76f0a7cf rsp=ffffc60a9218eba0 rbp=0000000000000001
r8=0000000000000001 r9=ffffc60a91c7e910 r10=fffff806e164c190
r11=ffffc60a9218eb98 r12=0000000000000000 r13=0000000000000090
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47:
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax ds:002b:00000000`c000cf29=????????????????
Resetting default scope
PROCESS_NAME: abort_type_confusion.exe
IP_IN_PAGED_CODE:
cldflt!CldiStreamPrepareRequestForMoreProcessing+47
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax
STACK_TEXT:
ffffc60a`9218eba0 fffff80f`76f110d1 : 00000000`00000000 ffffa487`d6a92f80 00000000`00000090 00000000`00000000 : cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
ffffc60a`9218ebd0 fffff80f`76f3f7fb : ffffc60a`91c7e908 fffff806`e2242e80 fffff806`e16d06d0 fffff806`72f42a26 : cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
ffffc60a`9218ec00 fffff80f`76f3c448 : ffffa487`d6a6efa0 00000000`00000000 ffffa487`d6a9ef88 ffff918f`45df0958 : cldflt!CldStreamAbortOperation+0x123
ffffc60a`9218ec50 fffff80f`76f3a045 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldSyncAbortOperation+0x108
ffffc60a`9218ecb0 fffff80f`76f7b232 : 00000000`00004002 00000000`00000001 00000001`00000000 ffffa487`bd8b2fd0 : cldflt!CldiPortProcessAbortHydration+0x599
ffffc60a`9218ed30 fffff80f`76f4af49 : 00000000`00004002 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x76
ffffc60a`9218ed60 fffff806`72f43622 : ffffa487`d6a42ee0 000000f2`a32ff9a0 00000000`0000016c 000000f2`a32ff960 : cldflt!CldiPortNotifyMessage+0xcc9
ffffc60a`9218ee70 fffff806`72f8f632 : ffff918f`46e61490 000000f2`a32ff9a0 ffff918f`46e61560 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
ffffc60a`9218eee0 fffff806`72f4b9c3 : ffff918f`46e61490 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
ffffc60a`9218ef50 fffff806`e167ccfb : 918f4471`c430fffe 00000000`00060000 ffff918f`4471c460 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
ffffc60a`9218eff0 fffff806`e167cc73 : ffff918f`4471c460 ffff918f`4471c460 00000000`00000000 ffff918f`45df0958 : nt!IopfCallDriver+0x5b
ffffc60a`9218f030 fffff806`e1ceb3a5 : ffff918f`4471c460 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
ffffc60a`9218f060 fffff806`e1cea1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffc60a`9218f110 fffff806`e1ce983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffc60a`9218f380 fffff806`e1adc558 : 00000000`00000001 000000f2`a32fe200 ffffc60a`9218f4e0 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffc60a`9218f3f0 00007ffa`37901d84 : 00007ffa`2a293bc2 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x28
000000f2`a32ff858 00007ffa`2a293bc2 : 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 00000000`00000060 : ntdll!NtDeviceIoControlFile+0x14
000000f2`a32ff860 00007ffa`2a2931a1 : 00000000`000000c8 00000000`00000000 00000000`000000bc 00000000`00000014 : FLTLIB!FilterpDeviceIoControl+0x13e
000000f2`a32ff8d0 00007ff6`16c14249 : 000001f6`d43c0000 00000000`00000048 00000000`00000470 00007ffa`377c8771 : FLTLIB!FilterSendMessage+0x31
000000f2`a32ff920 000001f6`d43c0000 : 00000000`00000048 00000000`00000470 00007ffa`377c8771 000001f6`00000040 : abort_type_confusioin+0x4249
SYMBOL_NAME: cldflt!CldiStreamPrepareRequestForMoreProcessing+47
MODULE_NAME: cldflt
IMAGE_NAME: cldflt.sys
STACK_COMMAND: .cxr 0xffffc60a9218e170 ; kb
BUCKET_ID_FUNC_OFFSET: 47
FAILURE_BUCKET_ID: AV_VRF_cldflt!CldiStreamPrepareRequestForMoreProcessing
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4129a4d8-43d0-209f-5056-9e4af3e36ca6}
Followup: MachineOwner
---------
Vendor Link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80093
2026-06-12 - Vendor Disclosure
2026-09-08 - Vendor Patch Release
2026-09-08 - Public Release
Marcin 'Icewall' Noga of Cisco Talos