CVE-2022-41077
published 2022-12-13CVE-2022-41077: Windows Fax Compose Form Elevation of Privilege Vulnerability
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.52%
40.4th percentile
Windows Fax Compose Form Elevation of Privilege Vulnerability
Affected
45 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19624 | 10.0.10240.19624 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5582 | 10.0.14393.5582 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2364 | 10.0.19042.2364 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2364 | 10.0.19043.2364 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.2364 | 10.0.19044.2364 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2364 | 10.0.19045.2364 |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.1335 | 10.0.22000.1335 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.993 | 10.0.22621.993 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20721 | 6.3.9600.20721 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21815 | 6.0.6003.21815 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24018 | 6.2.9200.24018 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20721 | 6.3.9600.20721 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Fax Compose Form Elevation of Privilege Vulnerability
vendor_msrc·2022-12-13·CVSS 7.8
CVE-2022-41077 [HIGH] Windows Fax Compose Form Elevation of Privilege Vulnerability
Windows Fax Compose Form Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.
FAQ: In what scenarios is my computer vulnerable?
For Windows 11 and Windows 10 the FAX service is not installed by default. For the vulnerability to be exploitable, the Windows Fax and Scan feature needs to be enabled, and the Fax service needs to be running. Systems that do not have the Fax service running are not vulnerable.
How can I verify whether the Fax service is running?
Hold the Windows key and press R on your keyboard. This will open the Run dialog.
Type services.msc and press Enter to open the Services window.
Scro
GHSA
GHSA-f9g9-qcpx-rfvp: Windows Fax Compose Form Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-12-13
CVE-2022-41077 [HIGH] GHSA-f9g9-qcpx-rfvp: Windows Fax Compose Form Elevation of Privilege Vulnerability
Windows Fax Compose Form Elevation of Privilege Vulnerability.
No detection rules found.
No public exploits indexed.
Qualys
The December 2022 Patch Tuesday Security Update Review | Qualys
blogs_qualys·2022-12-13·CVSS 7.8
CVE-2022-41089 [HIGH] The December 2022 Patch Tuesday Security Update Review | Qualys
#### Table of Contents
- Microsoft Patches for December 2022
- Adobe Patches for December 2022
- Notable Microsoft Vulnerabilities Patched
- Microsoft Critical Vulnerability Highlights
- CVE-2022-41089 | .NET Framework Remote Code Execution Vulnerability
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Welcome to the final second Tuesday of the year. As expected, Microsoft and Adobe have released their latest security updates and fixes. Take a break from your holiday preparations and join us as we re
Qualys
The December 2022 Patch Tuesday Security Update Review
blogs_qualys·2022-12-13·CVSS 7.8
CVE-2022-41089 [HIGH] The December 2022 Patch Tuesday Security Update Review
## Table of Contents
Microsoft Patches for December 2022
Adobe Patches for December 2022
Notable Microsoft Vulnerabilities Patched
Microsoft Critical Vulnerability Highlights
CVE-2022-41089 | .NET Framework Remote Code Execution Vulnerability
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Welcome to the final second Tuesday of the year. As expected, Microsoft and Adobe have released their latest security updates and fixes. Take a break from your holiday preparations and join us as we review the detai
2022-12-13
Published