CVE-2022-37985
Published: 11 October 2022
Summary
CVE-2022-37985 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 12.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-37985 is an information disclosure vulnerability in the Windows Graphics Component. It received a CVSS 3.1 score of 5.5 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating that successful exploitation can expose sensitive data without affecting integrity or availability.
A local attacker with low privileges can exploit the flaw without user interaction to read arbitrary information from the affected system. The vulnerability is reachable from a standard user context on Windows hosts running the impacted graphics code.
Microsoft has published official guidance and patches for the issue through its Security Response Center at the referenced URLs, directing administrators to apply the relevant updates for the Windows versions in use.
EPSS for the CVE rose from low values after disclosure to a recorded peak of 0.0527 on 2025-12-11 before receding to the current 0.0351, indicating a measurable increase in observed exploitation interest well after the original publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40592
Vulnerability details
Windows Graphics Component Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.