CVE-2022-21990

Deeper analysis

CVE-2022-21990 is a remote code execution vulnerability in the Remote Desktop Client component, assigned a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, no required privileges, and required user interaction. The weakness is tracked under NVD-CWE-noinfo and was publicly disclosed on 9 March 2022.

An unauthenticated attacker can exploit the flaw over the network by supplying a malicious RDP server or connection target that the victim client connects to, resulting in arbitrary code execution with full confidentiality, integrity, and availability impact on the affected system.

Microsoft publishes mitigation and patch guidance for the issue through its Security Response Center at the listed advisory URLs.

The associated EPSS score stands at 0.1827 with an identical recorded peak, indicating moderate exploitation probability without a material post-disclosure increase.