All vulnerabilities
CVE-2022-21971

Microsoft Windows Runtime Remote Code Execution Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 18 Aug 2022CISA KEV
Exploit odds (EPSS)53.8%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.17763.2565Also 10.0.18363.2094, 10.0.19043.1526 and 4 moreCVE List
Federal deadline8 Sep 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.17763.2565Windows 10 Version 1809CVE List
  • 10.0.17763.2565Windows Server 2019CVE List
  • 10.0.17763.2565Windows Server 2019 (Server Core installation)CVE List
  • 10.0.18363.2094Windows 10 Version 1909CVE List
  • 10.0.19043.1526Windows 10 Version 21H1CVE List
  • 10.0.20348.524Windows Server 2022CVE List
Show all 10 fixed versions
  • 10.0.19042.1526Windows 10 Version 20H2CVE List
  • 10.0.19042.1526Windows Server version 20H2CVE List
  • 10.0.22000.493Windows 11 version 21H2CVE List
  • 10.0.19044.1526Windows 10 Version 21H2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 9 Feb 2022, 16:36 UTCPublishedCVE List
  2. 18 Aug 2022Added to CISA KEVCISA KEV

Description

Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.

Text from CVE List

Affected versions 11

  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.2565CVE List
  • Windows 10 Version 1809affected: 10.0.0 before 10.0.17763.2565CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.2565CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.2565CVE List
  • Windows 10 Version 1909affected: 10.0.0 before 10.0.18363.2094CVE List
  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.1526CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.524CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.1526CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1526CVE List
  • Windows 11 version 21H2affected: 10.0.0 before 10.0.22000.493CVE List
  • Windows 10 Version 21H2affected: 10.0.19043.0 before 10.0.19044.1526CVE List

References 3