CVE-2022-33635

Deeper analysis

CVE-2022-33635 is a remote code execution vulnerability in the Windows GDI+ component. It carries a CVSS 3.1 base score of 7.8 with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that successful exploitation can result in full confidentiality, integrity, and availability impact on the affected system.

An attacker with the ability to supply a malicious file or document can trigger the flaw when a user opens or previews the content on a vulnerable Windows installation. Because no privileges are required beyond normal user interaction and the attack occurs locally, the vulnerability enables arbitrary code execution under the context of the logged-on user, potentially allowing complete takeover of the affected host.

Microsoft has published remediation guidance and patches for the issue through its Security Response Center at the referenced URLs, directing administrators to apply the updates listed in the CVE advisory to address the vulnerability. The associated EPSS score has remained flat at 0.0689 with no material increase since disclosure.