All vulnerabilities
CVE-2022-41125

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 8 Nov 2022CISA KEV
Exploit odds (EPSS)3.05%Chance of exploitation activity in the next 30 days, higher than 87% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.10240.19567Also 10.0.14393.5501, 10.0.17763.3650 and 9 moreCVE List
Federal deadline9 Dec 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.10240.19567Windows 10 Version 1507CVE List
  • 10.0.14393.5501Windows 10 Version 1607CVE List
  • 10.0.17763.3650Windows 10 Version 1809CVE List
  • 10.0.19042.2251Windows 10 Version 20H2CVE List
  • 10.0.19043.2251Windows 10 Version 21H1CVE List
  • 10.0.19044.2251Windows 10 Version 21H2CVE List
Show all 19 fixed versions
  • 10.0.19045.2251Windows 10 Version 22H2CVE List
  • 10.0.22000.1219Windows 11 version 21H2CVE List
  • 10.0.22621.819Windows 11 version 22H2CVE List
  • 6.3.9600.20671Windows 8.1CVE List
  • 6.2.9200.23968Windows Server 2012CVE List
  • 6.2.9200.23968Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.20671Windows Server 2012 R2CVE List
  • 6.3.9600.20671Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.5501Windows Server 2016CVE List
  • 10.0.14393.5501Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.3650Windows Server 2019CVE List
  • 10.0.17763.3650Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.1249Windows Server 2022CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Nov 2022Added to CISA KEVCISA KEV
  2. 9 Nov 2022, 00:00 UTCPublishedCVE List

Description

Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

Text from CVE List

Affected versions 20

  • Windows 10 Version 1507affected: 10.0.10240.0 before 10.0.10240.19567CVE List
  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.5501CVE List
  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.3650CVE List
  • Windows 10 Version 1809affected: 10.0.0 before 10.0.17763.3650CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.2251CVE List
  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.2251CVE List
  • Windows 10 Version 21H2affected: 10.0.19043.0 before 10.0.19044.2251CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.2251CVE List
  • Windows 11 version 21H2affected: 10.0.0 before 10.0.22000.1219CVE List
  • Windows 11 version 22H2affected: 10.0.22621.0 before 10.0.22621.819CVE List
  • Windows 8.1affected: 6.3.0 before 6.3.9600.20671CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.23968CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.23968CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.20671CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.20671CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.5501CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.5501CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.3650CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.3650CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.1249CVE List

References 4