CVE-2022-22037
Published: 12 July 2022
Summary
CVE-2022-22037 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Advanced Local Procedure Call (ALPC) contains an elevation of privilege vulnerability tracked as CVE-2022-22037. The flaw affects the ALPC component in Windows and carries a CVSS 3.1 base score of 7.5 with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
An attacker who already possesses a low-privileged network-authenticated session can exploit the issue to obtain full control over confidentiality, integrity, and availability on the target system. The attack requires high complexity and no user interaction, allowing the adversary to elevate privileges beyond the initial account.
Microsoft’s security update guide for CVE-2022-22037 directs administrators to install the patches released in the July 2022 Patch Tuesday cycle. The EPSS score has remained flat at a peak of 0.0844 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27191
Vulnerability details
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.