CVE-2022-24534HighCVSS 7.5

Win32 Stream Enumeration Remote Code Execution Vulnerability

Published
April 12, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-24534 →

📋 Description

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.

🎯 Affected products42

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • +12 more not shown

✅ Remediation

KB5012647 (Security Update) — fixed build 10.0.17763.2803 KB5012591 (Security Update) — fixed build 10.0.18363.2212 KB5012599 (Security Update) — fixed build 10.0.19043.1645 KB5012604 (Security Update) — fixed build 10.0.20348.643 KB5012599 (Security Update) — fixed build 10.0.19042.1645 KB5012592 (Security Update) — fixed build 10.0.22000.613 KB5012599 (Security Update) — fixed build 10.0.19044.1645 KB5012653 (Security Update) — fixed build 10.0.10240.19265 KB5012596 (Security Update) — fixed build 10.0.14393.5066 KB5012626 (Monthly Rollup) — fixed build 6.1.7601.25924 KB5012649 (Security Only) — fixed build 6.1.7601.25924 KB5012670 (Monthly Rollup) — fixed build 6.3.9600.20337 KB5012639 (Security Only) — fixed build 6.3.9600.20337 KB5012658 (Monthly Rollup) — fixed build 6.0.6003.21446 KB5012632 (Security Only) — fixed build 6.0.6003.21446 KB5012650 (Monthly Rollup) — fixed build 6.2.9200.23679 KB5012666 (Security Only) — fixed build 6.2.9200.23679

🔗 References (31)