CVE-2022-24490

Deeper analysis

Windows Hyper-V contains an information disclosure vulnerability affecting shared virtual hard disks. The flaw, tracked as CVE-2022-24490, received a CVSS 3.1 score of 8.1 reflecting network attack vector, low complexity, and low required privileges, with high impact to confidentiality and availability.

An authenticated attacker with low privileges can exploit the issue over the network without user interaction to obtain sensitive information from shared virtual hard disk configurations and potentially disrupt availability. The vulnerability resides in the Hyper-V component responsible for handling shared VHDs, allowing information exposure that would otherwise be restricted.

Microsoft has published guidance for the vulnerability through its Security Response Center, including details on available updates and configuration changes that address the exposure in supported Windows versions. The EPSS score reached a peak of 0.1587 with a current value of 0.1321, indicating moderate but not sharply escalating exploitation interest since disclosure.