CVE-2022-37974
Published: 11 October 2022
Summary
CVE-2022-37974 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 6.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-37974 is an information disclosure vulnerability affecting Windows Mixed Reality Developer Tools. The flaw carries a CVSS 3.1 base score of 6.5 with a network attack vector, low complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality while leaving integrity and availability unaffected.
An unauthenticated remote attacker can exploit the issue by convincing a target to interact with specially crafted content, after which sensitive information from the affected Mixed Reality environment may be disclosed without further user action.
Microsoft has published security guidance for the vulnerability through its Security Response Center, directing administrators to the update catalog and advisory pages for remediation details. The associated EPSS score has remained stable at 0.1081 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40581
Vulnerability details
Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.