Security researcher Chaotic Eclipse, also known as Nightmare Eclipse, has released a proof-of-concept exploit for a Windows local privilege escalation zero-day dubbed “MiniPlasma,” which allows attackers to gain SYSTEM privileges on fully patched Windows systems by abusing the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw, tracked as CVE-2020-17103, affects the HsmOsBlockPlaceholderAccess routine and was originally reported by James Forshaw of Google Project Zero in 2020, which Microsoft claimed to have patched in December of that year. However, Chaotic Eclipse alleges the vulnerability was never fully remediated or may have been reintroduced, noting that Forshaw’s original proof-of-concept reportedly still functions without modification. The exploit abuses the undocumented CfAbortHydration API to manipulate registry key creation within the .DEFAULT user hive, enabling privilege escalation from a standard user account to SYSTEM. Testing by BleepingComputer and security researcher Will Dormann confirmed the exploit works reliably on fully updated Windows 11 systems running the May 2026 Patch Tuesday updates, although it reportedly fails on the latest Windows Insider Canary builds, suggesting Microsoft may already be testing a fix. The disclosure also highlights ongoing concerns surrounding the Cloud Filter driver, as Microsoft patched another actively exploited privilege escalation flaw in the same component, CVE-2025-62221, in late 2025. MiniPlasma is the latest in a broader string of public Windows zero-day disclosures from Chaotic Eclipse, following BlueHammer, RedSun, UnDefend, YellowKey, and GreenPlasma, several of which were later observed being exploited in the wild.