CVE-2022-24492

Deeper analysis

CVE-2022-24492 is a remote code execution vulnerability in the Remote Procedure Call Runtime component. It carries a CVSS 3.1 base score of 8.8 with network attack vector, low attack complexity, no required privileges, and required user interaction, enabling high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the flaw by convincing a user to interact with a malicious file or network resource that triggers the vulnerable RPC path, resulting in arbitrary code execution on the target system.

Microsoft has published guidance for the issue in its Security Response Center advisory at the listed reference URL.

The associated EPSS score has remained essentially flat near 0.07 with only a negligible peak-to-current difference, indicating no material post-disclosure rise in observed exploitation interest.