The Ghost in the Code: "MiniPlasma" Zero-Day Reveals Critical Patch Regression in Windows 11

Executive Summary: A Resurrected Threat

In a startling development for the cybersecurity community, a newly disclosed zero-day vulnerability dubbed "MiniPlasma" has sent shockwaves through the Windows ecosystem. The vulnerability, which targets the Windows Cloud Filter driver, allows a local attacker with standard user privileges to escalate their permissions to the highest possible level—SYSTEM.

The most alarming aspect of the MiniPlasma discovery is not merely its effectiveness, but its origin. According to the independent researcher known as Chaotic Eclipse, the exploit is a functional resurrection of a flaw originally discovered in 2020 by Google Project Zero. Despite Microsoft’s claims of a definitive fix nearly six years ago, the vulnerability appears to have either remained unpatched in certain code branches or was inadvertently reintroduced during subsequent OS updates.

With independent verification from major security outlets and veteran analysts, the MiniPlasma zero-day represents a significant failure in the vulnerability remediation lifecycle, leaving hundreds of millions of Windows 11 users potentially exposed to local privilege escalation (LPE) attacks.

Chronology: From 2020 to the Present Day

The timeline of the MiniPlasma vulnerability is a cautionary tale of the complexities inherent in maintaining a massive, legacy-bound operating system like Windows.

December 2020: The Original Discovery

The story begins in late 2020, when James Forshaw of Google Project Zero identified a flaw in how the Windows Cloud Filter driver handled registry operations. Assigned CVE-2020-17103, the bug allowed an attacker to manipulate registry keys within the .DEFAULT hive through an undocumented API. Microsoft released a patch as part of its December 2020 "Patch Tuesday" cycle, claiming the issue was resolved.

2021–2025: The Silent Interval

For over five years, the vulnerability was considered a relic of the past. During this time, Windows 11 was launched, and the Cloud Filter driver underwent various iterations to support the expanding features of OneDrive and SharePoint integration. It is during this period that researchers suspect a "patch regression" occurred—a scenario where code changes or branch merging accidentally reverts a security fix.

May 18, 2026: The "MiniPlasma" Disclosure

The researcher Chaotic Eclipse published a Proof-of-Concept (PoC) on GitHub, demonstrating that the original 2020 exploit code worked on a fully patched version of Windows 11 Pro (Build 22631.3593). Chaotic Eclipse noted that the "fix" appeared to be non-existent in the current production builds, leading to the name "MiniPlasma" to distinguish this modern manifestation of the old flaw.

Supporting Data and Technical Analysis

The MiniPlasma exploit targets a specific component of the Windows kernel architecture: the Cloud Filter Driver (cldflt.sys). This driver is responsible for managing "placeholder" files—files that appear to be on the local disk but are actually stored in the cloud (such as OneDrive).

The Role of CfAbortHydration

At the heart of the exploit is an undocumented API function: CfAbortHydration. "Hydration" is the process by which a placeholder file is downloaded and converted into a full file on the local system.

The vulnerability stems from a logic error in how the driver handles registry key creation during a failed or aborted hydration process. By precisely timing an abortion request, an attacker can trick the driver into creating or modifying registry keys in the .DEFAULT user hive. Because the Cloud Filter driver operates with high-level kernel permissions, these registry operations bypass the standard Access Control Lists (ACLs) that usually prevent a standard user from modifying sensitive system configurations.

Privilege Escalation Mechanism

Once an attacker can write to the .DEFAULT hive, the path to SYSTEM privileges is well-documented. By modifying specific keys related to service execution or shell initialization, the attacker can ensure that the next time a system service triggers or a specific system-level event occurs, a command prompt or malicious payload is executed with SYSTEM-level authority.

Verification Results

The validity of the MiniPlasma zero-day has been confirmed by multiple high-profile sources:

• BleepingComputer: In controlled lab tests on a Windows 11 Pro machine running the May 2026 security updates, reporters successfully used the PoC to launch a cmd.exe instance with SYSTEM privileges from a guest-level account.
• Will Dormann: The principal vulnerability analyst at Tharros confirmed the exploit’s efficacy on public builds of Windows 11. However, Dormann noted a curious outlier: the exploit failed to run on the latest Windows 11 Insider Preview (Canary Channel). This suggests that Microsoft may have recently overhauled the Cloud Filter driver in development builds, or a different kernel-level protection in the Canary branch is inadvertently blocking the exploit.

Official Responses and the Industry Reaction

As of the latest reports, Microsoft’s response has followed its standard protocol for zero-day disclosures.

Microsoft’s Stance

A spokesperson for the Microsoft Security Response Center (MSRC) stated: "We are aware of the reports regarding a potential regression of CVE-2020-17103. Microsoft is committed to investigating reported security issues and will take the necessary action to protect customers. We recommend users keep their systems updated and follow security best practices."

Despite this, the company has not yet provided a specific timeline for a "re-patch." The community remains critical, as the disclosure highlights a perceived lack of "regression testing"—the practice of ensuring that new updates do not break old security fixes.

The Research Community

The Infosec community has reacted with a mix of frustration and alarm. Many researchers argue that the MiniPlasma case is symptomatic of a broader "maintenance debt" within the Windows kernel.

"The fact that a six-year-old PoC works without modification on a modern, ‘hardened’ OS is a massive red flag," says one anonymous security engineer. "It suggests that the original fix might have been a ‘band-aid’ rather than a fundamental architectural change, making it easy to break during subsequent updates."

Implications: The High Cost of Regression

The emergence of MiniPlasma carries heavy implications for both individual users and enterprise environments.

1. The Threat of Ransomware and Persistence

Local Privilege Escalation is a critical "middle step" in the cyberattack chain. While it cannot be used to break into a computer remotely (an attacker first needs a foothold via phishing or another exploit), it allows an intruder to disable antivirus software, steal credentials from memory, and deploy ransomware across an entire network. MiniPlasma makes these actions trivial for any attacker who manages to gain even the most basic access to a Windows 11 workstation.

2. Erosion of Trust in the Patching Process

For years, the primary advice from security professionals has been "patch early and patch often." However, when patches are "rolled back" or prove ineffective over time, it creates a crisis of confidence. Organizations that invest heavily in patch management expect that once a CVE is closed, it stays closed. MiniPlasma challenges this assumption.

3. The Need for Better Regression Testing

The incident serves as a wake-up call for software giants to implement more robust automated testing. If Microsoft’s internal testing suites had included the original 2020 PoC as a "negative test case" (a test to ensure the bug hasn’t returned), MiniPlasma might have been caught before reaching production builds.

4. Immediate Mitigation Strategies

Until an official patch is released, security administrators are advised to:

• Monitor Registry Changes: Implement File Integrity Monitoring (FIM) or EDR rules to alert on unexpected modifications to the .DEFAULT user hive.
• Restrict Local Access: Minimize the number of users with local access to sensitive machines, as this is a local exploit.
• Audit Cloud Filter Usage: In environments where OneDrive/SharePoint is not required, consider disabling or restricting the Cloud Filter driver via Group Policy, though this may impact system functionality.

Conclusion

MiniPlasma is more than just a bug; it is a reminder that in the world of cybersecurity, the past is never truly dead. As Windows 11 continues to evolve, the burden of its legacy code remains a primary attack surface. The security world now looks to Microsoft’s June 2026 Patch Tuesday to see if the "ghost" of CVE-2020-17103 can finally be laid to rest.