MiniPlasma — The Ghost Patch: A 5-Year-Old Windows LPE That Never Died
TL;DR MiniPlasma is a Windows local privilege escalation exploit that achieves standard user → SYSTEM on fully patched Windows 11 systems (including the May 2026 Patch Tuesday updates). The jaw-dropper? It targets the exact same vulnerability that Google Project Zero reported in September 2020 and Microsoft claimed to fix in December 2020. CVE: CVE-2020-17103 (CVSS 7.0) — supposedly patched Component: cldflt.sys — Windows Cloud Files Minifilter driver Flaw: TOCTOU race condition in HsmOsBlockPlaceholderAccess Impact: Full SYSTEM shell from standard user Affected: All Windows versions (confirmed on Win11 with May 2026 updates) Not affected: Latest Windows 11 Insider Preview Canary builds (suggests a fix may be incoming) Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/MiniPlasma The Ghost Patch Problem In cybersecurity, few things are more unsettling than a patch that never actually landed. That’s exactly what happened here. ...