CVE-2022-37989

Deeper analysis

CVE-2022-37989 is an elevation of privilege vulnerability affecting the Windows Client Server Run-time Subsystem (CSRSS). It carries a CVSS 3.1 base score of 7.8 with an attack vector that is local, low complexity, and requires only low privileges without user interaction, resulting in high impact to confidentiality, integrity, and availability.

A local attacker who already possesses a low-privileged account on an affected Windows system can exploit the flaw to obtain higher privileges. Successful exploitation would allow the attacker to execute arbitrary code with elevated rights, potentially leading to full control over the compromised host.

Microsoft has published security guidance and patches addressing the issue through its update channels at the referenced MSRC advisory pages. The current EPSS score of 0.1102, with a recorded peak of 0.1203, indicates moderate and relatively stable exploitation interest since disclosure.