CVE-2022-41033
Memory Safety in Microsoft Windows Server 2008 r2
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-41033 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 21% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-41033 is an elevation-of-privilege vulnerability in the Windows COM+ Event System Service, assigned CWE-843 and carrying a CVSS 3.1 base score of 7.8. The flaw permits a local attacker to obtain higher privileges on affected Windows systems without requiring user interaction.
An authenticated local user can exploit the weakness to achieve full control over confidentiality, integrity, and availability on the host. Because the attack vector is local and the required privileges are only low, any process or user already present on the system can leverage the bug to escalate to SYSTEM-level access.
Microsoft has published security updates and advisory guidance at the listed MSRC URLs to address the issue. The vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation, although the associated EPSS score has remained flat at 0.0174.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44278
Vulnerability Data
Windows COM+ Event System Service Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 October 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V15.3.5
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-confusion flaws via safe typing, static analysis, and code review while the control itself addresses many additional weaknesses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.