CVE-2022-21880
Published: 11 January 2022
Summary
CVE-2022-21880 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows GDI+ contains an information disclosure vulnerability tracked as CVE-2022-21880. The flaw resides in the Windows graphics device interface plus component and carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, and no required privileges or user interaction.
An unauthenticated remote attacker can send specially crafted input over the network to trigger the flaw and obtain sensitive information from the affected system, while integrity and availability remain unaffected.
Microsoft security advisories for CVE-2022-21880, published on the MSRC portal, describe the issue and direct administrators to the corresponding security updates that address the vulnerability. The associated EPSS score has remained flat at 0.1954 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27036
Vulnerability details
Windows GDI+ Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.