CVE-2022-38006

Deeper analysis

The vulnerability is an information disclosure flaw in the Windows Graphics Component, assigned CVE-2022-38006 and published in September 2022. It carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality with no integrity or availability effects.

An unauthenticated remote attacker can exploit the issue by supplying a specially crafted file or content that a user opens or renders in an affected Windows environment, allowing the attacker to read sensitive information from the target system without further interaction or elevation.

Microsoft has published remediation guidance and patches for the vulnerability through its Security Response Center at the listed MSRC advisory URLs, which practitioners should consult for the applicable security updates. The associated EPSS score has remained flat at its peak value of 0.2612 with no material post-disclosure increase.