CVE-2022-21919

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-21919 is an elevation-of-privilege vulnerability in the Windows User Profile Service that stems from improper link resolution (CWE-59). It affects multiple Windows releases and carries a CVSS 3.1 score of 7.0 reflecting local attack vector, high attack complexity, and low-privileged access that can still yield full confidentiality, integrity, and availability impact.

A local attacker who already possesses a low-privileged account on an affected system can exploit the flaw to escalate to higher privileges. Successful exploitation grants the ability to read, modify, or delete protected data and to perform actions normally reserved for more privileged accounts.

Microsoft security updates addressing the issue are available through the Microsoft Security Response Center advisories. The vulnerability is also listed in CISA’s Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.

EPSS for the CVE remained low for an extended period before rising sharply to a peak of 0.8767 on 2024-12-03 and later receding, demonstrating a clear post-disclosure surge in exploitation interest that warrants renewed attention.