CVE-2022-21882

Exploited in the wild. In CISA KEV since 2022‑02‑04. A vendor fix is available.

CVSS 3.17.0High EPSS percentile99th59% chance in 30 days CISA KEVListedsince 2022-02-04, due 2022-02-18
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2022-01-11Updated 2026-08-15Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Win32k Elevation of Privilege Vulnerability

In plain language

Written by AI from the record

This is a Windows flaw that lets someone with basic access take full control of the computer; because it has been used in ransomware-related activity, small businesses should act quickly by installing the Microsoft fixes.

CVE-2022-21882 is a local kernel elevation of privilege vulnerability (CWE-787) in the Win32k/Windows kernel graphics path, where an attacker with low-level local privileges can exploit a memory corruption weakness to gain administrative control of the device.

If you're affected

Full device takeover
Ransomware-ready access
Data theft risk
System disruption

What is it

Think of Windows as a building and the graphics system as one special hallway. This bug is like a crack in the hallway wall that lets an attacker who already has some inside access quietly break out into the manager’s office—full control of the entire computer.

Who is affected

This matters to you if you run or manage affected Windows machines (Windows 10, Windows 11, Windows Server 2019, or Windows Server 2022) and attackers can get low-level access on the device. It does not require tricking users to click something, and it starts from an attacker already having basic local privileges.

How urgent is it

This is RED because it is listed in CISA KEV and has been used in ransomware campaigns. Attackers don’t need a user to click or interact, only low-level local privileges, so once someone is on the machine, the bug can help them take full control quickly.

What to do — in detail

Confirm exposure by identifying your exact OS edition and installed build.

Check the Windows build number on each affected system (for example, via the system “About” page or your device management console).

Compare to Microsoft fixed versions for CVE-2022-21882.

Windows 10 is fixed at: 10.0.17763.2452, 10.0.18363.2037, 10.0.19042.1466, 10.0.19043.1466, or 10.0.19044.1466.
Windows 11 is fixed at: 10.0.22000.434.
Windows Server 2019 is fixed at: 10.0.17763.2452.
Windows Server 2022 is fixed at: 10.0.20348.469.
(The Server 2019/2022 and listed Server branch fixed-build mappings above should be used based on your exact OS.)

Patch with the vendor’s guidance.

Install the Microsoft update(s) for CVE-2022-21882 using Windows Update or your standard patch-management process, following Microsoft’s update guide.
Use the Microsoft links in the patch cards / update guide for CVE-2022-21882 to make sure you pull the correct servicing branch.

Validate after patching.

Re-check the Windows build number after reboot to confirm it is now at (or above) the fixed version listed for your specific OS branch.

If patching is delayed (temporary workaround).

Reduce the chance of an attacker obtaining low-level local privileges: limit local logons, remove unnecessary accounts, and tighten endpoint access controls (including helpdesk/service accounts).
Prioritize patching for machines that are most exposed to attackers (systems with many users, exposed remote access, or frequent credential access).

What to monitor while remediating.

Look for signs of local compromise and privilege escalation attempts on endpoints (failed logons, creation of new local accounts, abnormal admin/group changes, unexpected service/driver activity). Specific indicators are not provided in the findings, so monitoring should focus on general local compromise signals.

CISA remediation due date (from KEV): 2022-02-18.

Technical context

Severity is described as HIGH (CVSS 7). The weakness is CWE-787 (out-of-bounds write / memory corruption class leading to privilege escalation). The attack is local and requires low-level local privileges; there is no user interaction required. Public proof-of-concept code exists, and CISA KEV confirms real-world exploitation used in ransomware campaigns (added 2022-02-04), which is why the operational priority is highest. KEV means CISA has identified evidence of exploitation in the wild and expects defenders to remediate accordingly. EPSS is not used to drive urgency here because the exploitation confirmation from KEV overrides predictions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2022-02-04.

US federal agencies must remediate by 2022-02-18.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

59% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 127 days before any public exploit.

2026-08-15Patch availablerecord updated
2026-06-25OpenVAS check added
2026-05-04EPSS band changecritical → high
2026-03-30EPSS band changehigh → critical
2026-03-06Public exploit / PoCsource: github-poc
2025-10-30Patch availablerecord updated

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable