CVE-2022-35833

Deeper analysis

Windows Secure Channel in multiple versions of Microsoft Windows is affected by CVE-2022-35833, a denial-of-service vulnerability that carries a CVSS 3.1 base score of 7.5. The flaw resides in the Secure Channel (Schannel) component responsible for TLS/SSL handling and can be triggered remotely without authentication or user interaction, resulting in high impact to availability while leaving confidentiality and integrity untouched.

An unauthenticated attacker can send specially crafted network packets to a vulnerable Windows system listening on standard TLS ports. Successful exploitation causes the target service or the entire system to become unresponsive, producing a denial-of-service condition that requires administrative intervention to restore.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35833 supplies patch details and mitigation guidance for supported Windows releases. The associated EPSS score has remained flat at 0.1951 with no material increase after disclosure.