What is CVE-2022-21907?

CVE-2022-21907 is a security advisory published by Microsoft Security Response Center (MSRC) with Critical severity. HTTP Protocol Stack Remote Code Execution Vulnerability

Which CVE IDs does CVE-2022-21907 cover?

CVE-2022-21907 covers the following CVE IDs: CVE-2022-21907. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2022-21907?

CVE-2022-21907 has a CVSS v3 base score of 9.8, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2022-21907?

CVE-2022-21907 affects 18 products, including: Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for ARM64-based Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 20H2 for 32-bit Systems; Windows 10 Version 20H2 for ARM64-based Systems; and others — see the full list on the advisory page.

CVE-2022-21907CriticalCVSS 9.8

HTTP Protocol Stack Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

January 11, 2022

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2022-21907 →

📋 Description

How could an attacker exploit this vulnerability? In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets. Is this wormable? Yes. Microsoft recommends prioritizing the patching of affected servers.

Windows 10, Version 1909 is not in the Security Updates table. Is it affected by this vulnerability? No, the vulnerable code does not exist in Windows 10, version 1909. It is not affected by this vulnerability. Is the EnableTrailerSupport registry key present in any other platform than Windows Server 2019 and Windows 10, version 1809? No, the registry key is only present in Windows Server 2019 and Windows 10, version 1809.

🎯 Affected products18

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)

✅ Remediation

KB5009557 (Security Update) — fixed build 10.0.17763.2452 KB5009543 (Security Update) — fixed build 10.0.19043.1466 KB5009555 (Security Update) — fixed build 10.0.20348.469 KB5009543 (Security Update) — fixed build 10.0.19042.1466 KB5009566 (Security Update) — fixed build 10.0.22000.434 KB5009543 (Security Update) — fixed build 10.0.19044.1466

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products18

✅ Remediation

🔗 References (9)