Proof-of-concept MiniPlasma Windows exploit targets 2020 patch gap

A security researcher has released a proof-of-concept exploit for a privilege escalation vulnerability in Windows, claiming that a security flaw originally reported and patched in 2020 remains unpatched in current systems. The exploit, dubbed "MiniPlasma," allows attackers to gain SYSTEM-level privileges on fully updated Windows 11 devices.

The vulnerability affects the Windows Cloud Files Mini Filter Driver, specifically within a routine named HsmOsBlockPlaceholderAccess. It was originally reported to Microsoft by a researcher from Google's Project Zero in September 2020 and was assigned the identifier CVE-2020-17103. Microsoft issued a patch for it in December 2020.

The researcher known as Chaotic Eclipse, who also operates under the alias Nightmare Eclipse, stated that recent investigation revealed the original issue is still present. In a GitHub release, the researcher said the original proof-of-concept code from 2020 works without modification on systems running the latest May 2026 security updates. Chaotic Eclipse weaponized this code to create the MiniPlasma exploit, which spawns a command shell with SYSTEM privileges. The researcher noted the exploit's success rate may...