CVE-2022-21882: high-severity vulnerability in Microsoft Windows 10 Version 1809
Win32k Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply updates per vendor instructions.
A flaw in Windows' display driver interface allows an attacker with local access to run malicious code with system-level privileges. This is dangerous because it can give attackers complete control over your computer.
CWE-787 (Out-of-bounds Write) in Win32k.sys allows local authenticated users to perform privilege escalation through improper memory handling in the graphics subsystem. Exploitation requires local code execution and results in SYSTEM-level access.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.