Finding vulnerabilities in ClipSp, the driver at the core of Windows’ Client License Platform

Cisco Talos researchers examined the obfuscated Microsoft ClipSp (clipsp.sys) driver used for licensing and system policies on Windows 10/11, deobfuscated it (Warbird obfuscation), and discovered eight vulnerabilities — including signature bypasses, TLV parsing flaws, out-of-bounds reads/writes, and race conditions — that can enable privilege escalation and LPAC sandbox escape; the report includes analysis of driver interfaces, license formats, exploitation primitives, and a PoC-level discussion of exploitation challenges.