CVE-2022-23293

This is a Windows kernel elevation-of-privilege bug in the Fast FAT file system driver. The one-line title is all Microsoft gives, but the vector fills it in: local access, low privileges already required, no user interaction, and full compromise of confidentiality, integrity, and availability. In practice an attacker who can already run code on the machine as an ordinary user leverages a flaw in FAT parsing to escalate to SYSTEM.

Local privilege escalation is not how attackers get in — it's how they finish the job once they're in. That makes this a post-compromise tool: valuable to ransomware operators and hands-on intruders who have an initial low-privileged foothold (via phishing, a browser bug, stolen creds) and need SYSTEM to disable defenses, dump credentials, and move laterally. It doesn't self-propagate and it isn't remotely reachable, which is why it's high rather than critical, but LPE bugs are workhorses in real intrusion chains and shouldn't be dismissed as "only local."

Our approach is standard Patch Tuesday fleet coverage, prioritized by exposure to initial-access risk. Since this only pays off after an attacker already has a foothold, we rank it as a chaining component: important to close broadly through the normal Windows update cadence, with extra urgency on multi-user machines and endpoints most likely to catch initial access. It's the second half of an attack, so we weigh it as defense-in-depth against attackers who are already inside rather than a front-door emergency.