CVE-2022-30221

Deeper analysis

The vulnerability tracked as CVE-2022-30221 is a remote code execution flaw in the Windows Graphics Component. It received a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, no required privileges, and required user interaction, with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the issue by delivering specially crafted content that a user opens or views, resulting in arbitrary code execution within the context of the current user. The attack does not require the attacker to be authenticated or to have prior access to the target system.

Microsoft advisories published at the referenced MSRC pages address the vulnerability and indicate that patches are available through standard Windows update channels. The associated EPSS scores remained low and essentially flat, with a current value of 0.0500 against a recorded peak of 0.0526.