CVE-2022-21974

Deeper analysis

CVE-2022-21974 is a remote code execution vulnerability in Roaming Security Rights Management Services. The affected component is part of Microsoft's rights-management infrastructure and carries a CVSS 3.1 base score of 7.8 with an attack vector that is local, requires low complexity, needs no privileges, and depends on user interaction.

An attacker who can supply a malicious file or document to a local user can trigger arbitrary code execution, resulting in full compromise of confidentiality, integrity, and availability on the target system. Because the vector is local and user-interaction is required, the flaw is typically reached through phishing, malicious attachments, or compromised content opened on an affected workstation.

Microsoft has published guidance and patches for the issue at the MSRC update guide entry for CVE-2022-21974. The associated EPSS score has remained flat at 0.0881 with no material increase after disclosure.