CVE-2022-41049

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-41049 is a security feature bypass vulnerability in the Windows Mark of the Web (MOTW) mechanism, which tags files originating from the internet and triggers security warnings or restrictions in applications such as Microsoft Office and the Windows shell. The flaw affects multiple Windows versions and allows certain downloaded files to evade MOTW protections without requiring authentication or elevated privileges.

An unauthenticated remote attacker can exploit the issue by supplying a specially crafted file that, when opened by a user, bypasses MOTW safeguards. Successful exploitation can result in limited integrity and availability impacts, such as reduced security prompts or altered file handling behavior, while leaving confidentiality unaffected.

Microsoft has published updates addressing the vulnerability through its Security Response Center, and the flaw appears in CISA’s catalog of known exploited vulnerabilities, indicating confirmed in-the-wild use. The associated EPSS score rose from a low baseline to a peak of 0.2104, signaling increased exploitation interest after public disclosure.