CVE-2022-41106
Published: 09 November 2022
Summary
CVE-2022-41106 is a high-severity an unspecified weakness vulnerability in Microsoft Excel. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-41106 is a remote code execution vulnerability affecting Microsoft Excel. It carries a CVSS 3.1 base score of 8.8 with the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-accessible exploitation that can fully compromise confidentiality, integrity, and availability of affected systems.
An authenticated attacker with low privileges can exploit the flaw over the network without requiring user interaction, enabling arbitrary code execution on the target system. The unchanged scope rating means the impact remains contained to the vulnerable component rather than extending across security boundaries.
Microsoft Security Response Center advisories hosted at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41106 provide official guidance on patches and mitigation measures for the vulnerability.
The associated EPSS score has remained flat at a peak and current value of 0.1755, showing no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44349
Vulnerability details
Microsoft Excel Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.