PT-2021-6023 · Microsoft · Windows 11+4

Ryelv · Published 2021-04-23 · Updated 2026-06-13 · CVE-2022-21882

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 (affected versions not specified) Windows 11 (affected versions not specified) Windows Server 2019 (affected versions not specified) Windows Server 2022 (affected versions not specified)

Description An elevation of privilege issue exists in the Win32k component (win32k.sys) of the Windows NT kernel due to improper access control and a use-after-free flaw. A use-after-free occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. By manipulating window objects and their lifetime, an attacker can force the kernel to operate on a freed object under their control, enabling arbitrary kernel read/write capabilities to swap the current process token with the SYSTEM token. This issue has been actively exploited in real-world incidents, including use by ransomware for network propagation.

Recommendations Apply the updates provided by Microsoft in the January Tuesday updates for Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022.

Exploit

Fix

DoS

LPE

Improper Privilege Management

Memory Corruption

Weakness Enumeration

CWE-269

CWE-787

Related Identifiers

BDU:2022-00596

CVE-2022-21882

Affected Products

Windows

Windows 10

Windows 11

Windows Server 2019

Windows Server 2022

References · 57

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_21882_win32k.rb · Exploit
• 🔥 https://github.com/KaLendsi/CVE-2022-21882 · Exploit
• 🔥 https://github.com/L4ys/CVE-2022-21882 · Exploit
• 🔥 https://github.com/sailay1996/cve-2022-21882-poc · Exploit
• 🔥 https://github.com/David-Honisch/CVE-2022-21882 · Exploit
• 🔥 https://github.com/r1l4-i3pur1l4/CVE-2022-21882 · Exploit
• 🔥 http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html · Exploit
• https://bdu.fstec.ru/vul/2022-00596 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-21882 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21882 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/674885 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21882 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21882 · Security Note