Microsoft Defender for Endpoint Privilege Escalation Vulnerability

A vulnerability allowing external control of file names or paths in Microsoft Defender for Endpoint has been identified. This issue enables an authorized attacker to locally elevate privileges. The vulnerability arises from improper handling of file names or paths, which could be exploited to gain higher system privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain SYSTEM privileges.

Remediation

Users can verify if the security update is installed by running the MDE Client Analyzer on their device. The analyzer will indicate if the patch is missing or if there are issues with the Anti-Spoofing capability. For Microsoft Defender for Endpoint on Linux, the security update is included in version 101.25032.0008.