A patched Windows attack surface is still exploitable

This report analyzes a class of Windows local privilege‑escalation vulnerabilities (multiple CVEs including CVE‑2022‑22047, CVE‑2022‑37989, CVE‑2022‑29104, CVE‑2022‑41073, CVE‑2023‑36874, CVE‑2023‑35359) that abuse impersonation and the device map to remap the system root (C:\) to a writable ‘fake’ root, allowing unprivileged accounts to gain NT AUTHORITY\SYSTEM; it documents in‑the‑wild PoCs and packed exploits, affected services (CSRSS, WER, BITS, File History, Print Spooler), patch mitigations (changes to ObpLookupObjectName/ObpUseSystemDeviceMap and stopping impersonation before loading external resources), and practical detection indicators such as writable C:\-mirror folders, modified WinSxS manifests (LoadFrom or path traversal), and created symbolic links under RPC Control.