CVE-2022-21971
Windows Runtime Remote Code Execution Vulnerability
High
Known exploited
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 53.78%
- Chance of exploitation in the next 30 days. Higher than 99.00% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Aug 18, 2022
- Fix
- None yet
- No fixed version published
Exploited in the wild. Microsoft Windows Runtime Remote Code Execution Vulnerability (Microsoft Windows). Required action: Apply updates per vendor instructions. Due for U.S. federal agencies by Sep 8, 2022.
Description
Windows Runtime Remote Code Execution Vulnerability
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-109619 PHP has various global state that temporarily points into request memory. | Critical Known exploited | Same weakness, CWE-824 |
| CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. | Critical Known exploited | Same weakness, CWE-824 |
| GHSA-8qxc-57hf-hc9j Open Babel has uninitialized pointer dereference in PQS pFormat | High | Same weakness, CWE-824 |
| GHSA-jr2x-6qf6-q5mc Open Babel has uninitialized pointer dereference in MSI atom parser | High | Same weakness, CWE-824 |
| GHSA-mw5r-wq2m-397c Open Babel has uninitialized pointer dereference in GRO residue parser | High | Same weakness, CWE-824 |
| GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure | High | Same weakness, CWE-824 |
| GHSA-wj8w-pjxf-9g4f ImageMagick has uninitialized pointer dereference in JBIG decoder | High | Same weakness, CWE-824 |
| GHSA-7f6x-jwh5-m9r4 Cranelift vulnerable to miscompilation of constant values in division on AArch64 | High | Same weakness, CWE-824 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor