CVE-2022-21915
Published: 11 January 2022
Summary
CVE-2022-21915 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21915 is an information disclosure vulnerability affecting the Windows GDI+ component. It carries a CVSS 3.1 base score of 6.5 with a network attack vector, low attack complexity, and low privileges required, resulting in high impact to confidentiality while leaving integrity and availability unaffected.
An authenticated attacker with network access can exploit the flaw without user interaction to obtain sensitive information from a targeted system. The vulnerability does not require elevated rights, allowing a low-privileged account to read data that would otherwise be protected.
Microsoft has published security guidance and mitigation details for the issue through its Security Response Center advisories. The EPSS score has remained flat at a peak of 0.1423 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27071
Vulnerability details
Windows GDI+ Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.