Finding vulnerabilities in Clip Sp, the driver at the core of Windows’ Client License Platform
Summary: Cisco Talos researchers found eight vulnerabilities in clipsp.sys, the obfuscated Microsoft Windows 10 and 11 driver that implements client licensing and system policies, ranging from signature bypass to elevation of privilege and sandbox escape. The team deobfuscated the Warbird-protected driver using the Qiling emulation framework, then found that license parsing resumes after the signature entry, letting an attacker append unchecked data to a validly signed license, and that size assumptions on fields such as DeviceID produce out-of-bounds reads and a potential out-of-bounds write.
Key Takeaway: The driver's APIs are reachable from a Less Privileged Application Container, the same sandbox used for parsers and browser rendering processes, so an elevation of privilege bug here likely doubles as a sandbox escape.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026