CVE-2022-41033: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows COM+ Event System Service Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Windows COM+ Event System Service allows an attacker with local access to run code with higher privileges than their account normally allows, potentially taking full control of the system.
Type confusion vulnerability in COM+ Event System Service enables local privilege escalation through crafted COM object interactions. An authenticated local attacker can exploit improper object type validation to execute arbitrary code in the context of the SYSTEM account.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.