CVE-2022-35837

Deeper analysis

CVE-2022-35837 is an information disclosure vulnerability in the Windows Graphics Component. It carries a CVSS 3.1 base score of 6.5 with a network attack vector, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality and no impact to integrity or availability.

An unauthenticated remote attacker can exploit the flaw by convincing a user to open a specially crafted file or visit a malicious webpage, enabling the attacker to read sensitive information from the affected system without further interaction.

The referenced Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35837 provides official guidance on available patches and mitigation steps for supported Windows versions.

EPSS for the CVE rose from lower values after disclosure to a peak of 0.2612 on 2026-03-09 before receding to the current score of 0.1684, indicating a period of increased exploitation interest that later declined.