Windows CLFS Zero-Day - Zscaler Blog

This report provides a technical, step-by-step analysis of the CLFS kernel zero-day CVE-2022-37969 and its exploit that achieves local SYSTEM privilege escalation on Windows 10 and Windows 11. It describes the required environment, kernel structures involved (EPROCESS, TOKEN, ETHREAD), techniques used (heap spraying, arbitrary write via PipeAttribute and PreviousMode manipulation, token replacement), differences between Windows versions, gadget selection for a generic exploit, and mitigation guidance urging users to update and use protective products.