CVE-2022-41073KEV · OVERDUECWE-787

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

High · published November 10, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 83.6th percentile for exploit probability.

1415
days past CISA
deadline
CVSS v3.1
7.8
EPSS
2%
Percentile
83.6
In the wild
Confirmed
What it is

⚡ A sneaky elevation of privilege flaw hides in the Windows Print Spooler, letting attackers pull off some serious mischief! 🔥 Think of the Print Spooler as a busy post office. If an intruder can just waltz in and change the delivery addresses, they could reroute important packages to themselves without anyone batting an eye! An attacker could exploit this vulnerability to gain higher privileges on the system, potentially allowing them to install malicious software, modify data, or even create new user accounts. This could lead to a complete system compromise, impacting not only single machines but entire networks—definitely a recipe for chaos!

Put simply

Think of the Print Spooler as a busy post office. If an intruder can just waltz in and change the delivery addresses, they could reroute important packages to themselves without anyone batting an eye! This vulnerability occurs in the way the Print Spooler service handles requests, allowing an unauthenticated user to execute arbitrary code with elevated privileges. If an attacker tricks the system into executing their malicious commands, it's game over!

What to do

An attacker could exploit this vulnerability to gain higher privileges on the system, potentially allowing them to install malicious software, modify data, or even create new user accounts. This could lead to a complete system compromise, impacting not only single machines but entire networks—definitely a recipe for chaos! To mitigate this issue, immediately disable the Print Spooler service if it's not needed, and apply the latest security updates from Microsoft to version 1.0.0 or above. Regularly audit your systems to ensure that print services are only running where absolutely necessary. You've got this! By taking these steps, you can keep your systems secure and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02362 · 83.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2022-11-10T03:15Z
KEV added
2022-11-08 · due 2022-12-09
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1956710.0.10240.19567
microsoft/windows_10_1607< 10.0.14393.550110.0.14393.5501
microsoft/windows_10_1809< 10.0.17763.365010.0.17763.3650
microsoft/windows_10_20h2< 10.0.19042.225110.0.19042.2251
microsoft/windows_10_21h1< 10.0.19043.225110.0.19043.2251
microsoft/windows_10_21h2< 10.0.19044.225110.0.19044.2251
microsoft/windows_10_22h2< 10.0.19045.225110.0.19045.2251
microsoft/windows_11_21h2< 10.0.22000.121910.0.22000.1219
microsoft/windows_11_22h2< 10.0.22621.81910.0.22621.819
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_8.1all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.550110.0.14393.5501
microsoft/windows_server_2019< 10.0.17763.365010.0.17763.3650
microsoft/windows_server_2022< 10.0.20348.124910.0.20348.1249
References (4)
EPSS history
Timeline
  • 09 NOV 00:00Z
    Windows Print Spooler Elevation of Privilege Vulnerability
    cvelistv5
  • 08 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 9
    kev