CVE-2022-41091

Deeper analysis

CVE-2022-41091 is a security feature bypass vulnerability in the Windows Mark of the Web (MOTW) mechanism, which applies security identifiers to files originating from the internet or other untrusted zones. The flaw affects multiple Windows versions and allows certain file-handling operations to circumvent MOTW protections without requiring elevated privileges.

An unauthenticated remote attacker can exploit the issue by supplying a specially crafted file that triggers the bypass when opened or processed by a user. Successful exploitation results in limited impact, enabling modification of local files or disruption of availability while leaving confidentiality intact, as reflected in the CVSS vector.

Microsoft's advisory at msrc.microsoft.com directs administrators to apply the security updates released on November 8, 2022. The vulnerability is also catalogued in CISA's Known Exploited Vulnerabilities list, confirming active exploitation in the wild and underscoring the need for prompt patching.

EPSS scores have remained in a narrow band between 0.0634 and a peak of 0.0757, indicating moderate but stable exploitation interest without a pronounced post-disclosure surge.