PT-2022-1390 · Microsoft · Windows 11+4

M3Ik Shizuka

+1

·

Published

2022-01-11

·

Updated

2026-02-25

·

CVE-2022-21907

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version, including 10 20H2, 10 21H1, 10 21H2, 10 1809, 11, Server 20H2, Server 2019, and Server versions up to 2022.
Description The issue is related to a buffer overflow in the memory of the HTTP Protocol Stack in Microsoft Windows, allowing remote attackers to execute arbitrary code. This can lead to the execution of malicious code. The vulnerability is classified as "wormable" by Microsoft, meaning already compromised systems can be used to further develop the attack.
Recommendations For Microsoft Windows versions prior to the fixed version, including 10 20H2, 10 21H1, 10 21H2, 10 1809, 11, Server 20H2, Server 2019, and Server versions up to 2022, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the HTTP Protocol Stack to minimize the risk of exploitation. Avoid using vulnerable functions or parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-00163
CVE-2022-21907

Affected Products

Windows
Windows 10
Windows 11
Windows Server 2019
Windows Server 2022