CVE-2022-29130
Published: 10 May 2022
Summary
CVE-2022-29130 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-29130 is a remote code execution vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) component. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction, with full impacts to confidentiality, integrity, and availability.
An unauthenticated remote attacker can send specially crafted LDAP requests to a vulnerable Windows system and achieve arbitrary code execution, enabling complete compromise of the affected host.
Microsoft security advisories for CVE-2022-29130, available at the referenced MSRC pages, provide patch information and mitigation guidance for supported Windows versions. The associated EPSS scores have remained in the 0.12–0.14 range without a pronounced post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33540
Vulnerability details
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.