CVE-2022-41125: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Windows CNG Key Isolation Service allows an authenticated attacker to gain higher system privileges by exploiting an out-of-bounds write vulnerability. This could enable unauthorized access to sensitive cryptographic keys and system resources.
An out-of-bounds write (CWE-787) in the CNG Key Isolation Service permits local privilege escalation when a low-privileged authenticated user sends specially crafted requests. Successful exploitation grants SYSTEM-level privileges, potentially compromising cryptographic material and system integrity.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.