CVE-2022-38044

Deeper analysis

The vulnerability is a remote code execution flaw in the Windows CD-ROM File System Driver, assigned CVE-2022-38044 with a CVSS 3.1 base score of 7.8. It affects the CD-ROM file system driver component in Windows and was publicly disclosed on 11 October 2022.

An attacker can exploit the issue locally with low attack complexity and no privileges, provided the victim performs some user interaction such as opening a malicious file or media. Successful exploitation grants the ability to execute arbitrary code with high impact on confidentiality, integrity, and availability, effectively allowing full compromise of the affected system.

Microsoft has published security guidance and updates addressing the vulnerability through its Security Response Center at the referenced MSRC URLs. Administrators should apply the patches supplied in those advisories to eliminate the exposure.

EPSS for this CVE rose from low values after disclosure to a peak of 0.1103 on 2025-12-11 before receding to the current 0.0684, indicating a later surge in exploitation interest that warrants renewed attention.