Microsoft Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the WebDAV kernel-mode driver (mrxdav.sys) when it fails to properly validate and enforce impersonation levels. An attacker who successfully exploited this vulnerability could bypass impersonation-level security and gain elevated privileges on a targeted system, which could allow them to intercept WebDAV requests for files from any server (including corporate SharePoint sites) and redirect those file requests to return any, potentially malicious, files of the attacker’s choosing.

To exploit this vulnerability, an attacker would first have to log on to the system and then run a specially crafted application. User interaction is required to exploit this vulnerability. The update addresses the vulnerability by correcting how the Windows kernel-mode driver validates impersonation levels.