CVE-2022-24485

Deeper analysis

CVE-2022-24485 is a remote code execution vulnerability affecting the Win32 File Enumeration component. It carries a CVSS 3.1 base score of 7.5 with a vector indicating network attack vector, high attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the flaw by convincing a user to interact with specially crafted content delivered over a network connection. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the affected process.

Microsoft has published guidance for the issue in its security update guide at the listed reference URL. The associated EPSS score has remained flat at 0.0615 with no material increase since disclosure.