CVE-2022-37965

Deeper analysis

CVE-2022-37965 is a denial-of-service vulnerability in the Windows Point-to-Point Tunneling Protocol (PPTP) implementation. It affects the PPTP network component on supported Windows systems and carries a CVSS 3.1 base score of 5.9 reflecting high attack complexity but no privileges or user interaction required.

An unauthenticated remote attacker can trigger the flaw over the network to cause the affected PPTP service to stop responding, resulting in loss of availability for VPN connections that rely on the protocol. The attack vector requires the target to accept PPTP traffic and involves conditions that raise the complexity of successful exploitation.

Microsoft has published official guidance for the issue in its Security Update Guide and the Microsoft Security Response Center advisory portal, directing administrators to the relevant patches and configuration recommendations for affected Windows releases. The associated EPSS score has remained low and essentially flat since disclosure.