CVE-2022-21888

Deeper analysis

CVE-2022-21888 is a remote code execution vulnerability affecting the Windows Modern Execution Server component. It carries a CVSS 3.1 base score of 7.8 and was publicly disclosed on 11 January 2022.

An attacker can exploit the flaw by convincing a user to open a specially crafted file or trigger the vulnerable code path locally, requiring no prior authentication. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected process, resulting in full confidentiality, integrity, and availability impact on the target system.

Microsoft has published security guidance and patches addressing the issue through its update channels. The associated EPSS score rose from low values after disclosure to a peak of 0.0625 on 22 January 2025 before receding to the current 0.0383, indicating a later surge in exploitation interest that warrants renewed attention.