CVE-2022-26917HighCVSS 7.8

Windows Fax Compose Form Remote Code Execution Vulnerability

Published
April 12, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-26917 →

📋 Description

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

In what scenarios is my computer vulnerable? For Windows 11 and Windows 10 the FAX service is not installed by default. For the vulnerability to be exploitable, the Windows Fax and Scan feature needs to be enabled, and the Fax service needs to be running. Systems that do not have the Fax service running are not vulnerable. How can I verify whether the Fax service is running? Hold the Windows key and press R on your keyboard. This will open the Run dialog. Type services.msc and press Enter to open the Services window. Scroll through the list and locate the Fax service. If the Fax service is not listed, Windows Fax and Scan is not enabled and the system is not vulnerable. If the Fax service is listed but the status is not Running, then the system is not vulnerable at the time, but could be targeted if the service was started. The update should be installed as soon as possible or the Fax service should be removed if not needed.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user import a specially crafted contact record and then send it a FAX.

🎯 Affected products42

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • +12 more not shown

✅ Remediation

KB5012647 (Security Update) — fixed build 10.0.17763.2803 KB5012591 (Security Update) — fixed build 10.0.18363.2212 KB5012599 (Security Update) — fixed build 10.0.19043.1645 KB5012604 (Security Update) — fixed build 10.0.20348.643 KB5012599 (Security Update) — fixed build 10.0.19042.1645 KB5012592 (Security Update) — fixed build 10.0.22000.613 KB5012599 (Security Update) — fixed build 10.0.19044.1645 KB5012653 (Security Update) — fixed build 10.0.10240.19265 KB5012596 (Security Update) — fixed build 10.0.14393.5066 KB5012626 (Monthly Rollup) — fixed build 6.1.7601.25924 KB5012649 (Security Only) — fixed build 6.1.7601.25924 KB5012670 (Monthly Rollup) — fixed build 6.3.9600.20337 KB5012639 (Security Only) — fixed build 6.3.9600.20337 KB5012658 (Monthly Rollup) — fixed build 6.0.6003.21446 KB5012632 (Security Only) — fixed build 6.0.6003.21446 KB5012650 (Monthly Rollup) — fixed build 6.2.9200.23679 KB5012666 (Security Only) — fixed build 6.2.9200.23679

🔗 References (31)