CVE-2022-38041

Deeper analysis

Windows Secure Channel, a component responsible for implementing TLS and other cryptographic protocols in Windows, is affected by CVE-2022-38041, a denial-of-service vulnerability disclosed on 11 October 2022. The flaw carries a CVSS 3.1 base score of 7.5 and permits an unauthenticated network attacker to trigger a crash without any user interaction or special privileges.

An attacker positioned on the network can send crafted packets to a vulnerable Windows system listening for secure-channel connections, resulting in high impact to availability while leaving confidentiality and integrity untouched. Because the attack requires no authentication or user assistance, it can be launched remotely against any exposed endpoint that uses the affected Schannel implementation.

Microsoft has published security advisories and corresponding patches for the issue through its Security Response Center; administrators are advised to apply the updates referenced in the MSRC guidance to eliminate the denial-of-service condition. The EPSS score for this CVE has remained flat at its peak value of 0.2732 since disclosure, indicating no material increase in observed exploitation interest.