CVE-2022-44707

Deeper analysis

CVE-2022-44707 is a denial-of-service vulnerability in the Windows kernel, disclosed on 13 December 2022. The flaw carries a CVSS 3.1 base score of 6.5 and is characterized by network attack vector, low attack complexity, and low privileges required, resulting in high impact to availability while leaving confidentiality and integrity unaffected.

An authenticated attacker with low privileges can send specially crafted network traffic to a vulnerable system and trigger a kernel-level crash, producing a denial-of-service condition without any user interaction. The attack can be launched remotely, making any reachable Windows host that exposes the affected kernel code paths potentially susceptible.

Microsoft’s security advisory for CVE-2022-44707, published at the MSRC update guide, directs administrators to the corresponding security update that resolves the issue. The EPSS score has remained flat at 0.1071 with no material increase since disclosure, indicating limited observed exploitation interest to date.