CVE-2022-22038
Published: 12 July 2022
Summary
CVE-2022-22038 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 10.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-22038 is a remote code execution vulnerability in the Remote Procedure Call Runtime component. It carries a CVSS 3.1 base score of 8.1 with network attack vector, high attack complexity, and no requirements for privileges or user interaction, resulting in high impact to confidentiality, integrity, and availability. The issue was published on 12 July 2022 and is tracked under NVD-CWE-noinfo.
An unauthenticated remote attacker can exploit the flaw over the network, albeit with elevated complexity, to execute arbitrary code on an affected system and thereby gain full control of the target.
Microsoft has published official advisories for the vulnerability at the referenced MSRC pages, which detail available patches and guidance for remediation. The associated EPSS scores have remained low, with a current value of 0.0483 and a recorded peak of 0.0575.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27192
Vulnerability details
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.