Chaotic Eclipse, a notable figure in the realm of cybersecurity, has recently unveiled a proof-of-concept (PoC) for a Windows privilege escalation zero-day vulnerability that could potentially grant attackers SYSTEM privileges on fully patched Windows systems. This vulnerability, codenamed MiniPlasma, targets the “cldflt.sys” component, specifically within a routine known as “HsmOsBlockPlaceholderAccess.” The issue was initially flagged to Microsoft by James Forshaw, a researcher from Google Project Zero, back in September 2020.
While it was believed that Microsoft had resolved this vulnerability in December 2020 as part of CVE-2020-17103, further analysis by Chaotic Eclipse has revealed that the flaw remains unaddressed. The researcher expressed uncertainty regarding whether Microsoft failed to implement a patch or if a previous fix was inadvertently rolled back. “The original PoC by Google worked without any changes,” Chaotic Eclipse noted. “To highlight this issue, I weaponized the original PoC to spawn a SYSTEM shell. It seems to work reliably on my machines, but success rates may vary due to the nature of a race condition.”
Widespread Impact and Community Response
Chaotic Eclipse’s findings suggest that all versions of Windows could be susceptible to this vulnerability, raising significant concerns within the cybersecurity community. Will Dormann, another security researcher, shared insights on Mastodon, confirming that MiniPlasma effectively opens a “cmd.exe” prompt with SYSTEM privileges on Windows 11 systems equipped with the latest May 2026 updates. However, he noted that the exploit does not appear to function on the latest Insider Preview Canary version of Windows 11.
In December 2025, Microsoft addressed a separate privilege escalation flaw in the same component, identified as CVE-2025-62221, which received a CVSS score of 7.8. This vulnerability was reportedly being exploited by unidentified threat actors, further emphasizing the critical need for ongoing vigilance and proactive measures in cybersecurity.
