Windows CLFS Zero-Day Vulnerability CVE-2022-37969

Zscaler ThreatLabz presents a detailed root-cause analysis of CVE-2022-37969, a Windows Common Log File System (CLFS.sys) zero-day used in the wild for local privilege escalation. The report explains how a specially crafted base log file (BLF) overwrites the SignaturesOffset and bypasses cbSymbolZone validation, causing an out-of-bounds write that corrupts a CClfsContainer pointer and leads to a SYSTEM-level compromise or BSOD; it includes PoC steps, debugging traces, and mitigation (apply Microsoft September patch).