CVE-2022-41125KEV · OVERDUECWE-787

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

High · published November 10, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 87.4th percentile for exploit probability.

1414
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
87.4
In the wild
Confirmed
What it is

🚨 A sneaky privilege escalation in the Windows CNG Key Isolation Service could let attackers take control without breaking a sweat! ⚡️ Think of this as a clever office worker who discovers a way to access the CEO's office by pretending to be a janitor — they can then rummage through confidential files without anyone batting an eye. With this vulnerability, an attacker could elevate their privileges and gain full access to sensitive data and resources, potentially leading to system compromises or data breaches. It's an alarming situation, as malicious actors could manipulate the system to execute harmful commands or install additional malware. This could be absolutely devastating for any organization caught off-guard!

Put simply

Think of this as a clever office worker who discovers a way to access the CEO's office by pretending to be a janitor — they can then rummage through confidential files without anyone batting an eye. CVE-2022-41125 allows attackers to exploit a flaw in the Windows CNG Key Isolation Service, enabling them to elevate privileges and execute arbitrary code within the system context, bypassing standard security measures.

What to do

With this vulnerability, an attacker could elevate their privileges and gain full access to sensitive data and resources, potentially leading to system compromises or data breaches. It's an alarming situation, as malicious actors could manipulate the system to execute harmful commands or install additional malware. This could be absolutely devastating for any organization caught off-guard! To protect your systems, ensure you apply the latest security updates from Microsoft as soon as possible. Implement strict access controls and monitor user activities to detect any unusual behavior. Regularly audit your systems for potential vulnerabilities to stay ahead of threats. You've got this! By taking these steps, you can fortify your defenses and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03046 · 87.4th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2022-11-10T03:15Z
KEV added
2022-11-08 · due 2022-12-09
Affected products (16)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1956710.0.10240.19567
microsoft/windows_10_1607< 10.0.14393.550110.0.14393.5501
microsoft/windows_10_1809< 10.0.17763.365010.0.17763.3650
microsoft/windows_10_20h2< 10.0.19042.225110.0.19042.2251
microsoft/windows_10_21h1< 10.0.19043.225110.0.19043.2251
microsoft/windows_10_21h2< 10.0.19044.225110.0.19044.2251
microsoft/windows_10_22h2< 10.0.19045.225110.0.19045.2251
microsoft/windows_11_21h2< 10.0.22000.121910.0.22000.1219
microsoft/windows_11_22h2< 10.0.22621.81910.0.22621.819
microsoft/windows_8.1all versions—
microsoft/windows_8.1all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.550110.0.14393.5501
microsoft/windows_server_2019< 10.0.17763.365010.0.17763.3650
microsoft/windows_server_2022< 10.0.20348.124910.0.20348.1249
References (3)
EPSS history
Timeline
  • 09 NOV 00:00Z
    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
    cvelistv5
  • 08 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 9
    kev