CVE-2022-21904

Deeper analysis

Windows GDI is affected by an information disclosure vulnerability tracked as CVE-2022-21904. The flaw resides in the Graphics Device Interface component of Microsoft Windows and received a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction.

An unauthenticated remote attacker can send specially crafted network requests to a vulnerable system and obtain sensitive information from memory. Because the vulnerability permits high-impact confidentiality loss without altering data or causing denial of service, successful exploitation can expose internal application or system state that may aid further attacks.

Microsoft security advisories for CVE-2022-21904 direct administrators to apply the updates released on the January 2022 Patch Tuesday and provide additional configuration guidance for environments where immediate patching is not feasible. The associated EPSS score has remained flat at 0.1858 since disclosure, indicating no material increase in observed exploitation interest.