CVE-2022-44683
published 2022-12-13CVE-2022-44683: Windows Kernel Elevation of Privilege Vulnerability
PriorityP347high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
8.20%
94.2th percentile
Windows Kernel Elevation of Privilege Vulnerability
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19624 | 10.0.10240.19624 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5582 | 10.0.14393.5582 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2364 | 10.0.19042.2364 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2364 | 10.0.19043.2364 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.2364 | 10.0.19044.2364 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2364 | 10.0.19045.2364 |
| microsoft | windows_11 | — | — |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.1335 | 10.0.22000.1335 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.993 | 10.0.22621.993 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20721 | 6.3.9600.20721 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24018 | 6.2.9200.24018 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20721 | 6.3.9600.20721 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5582 | 10.0.14393.5582 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1366 | 10.0.20348.1366 |
| msrc | windows_10 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Kernel Elevation of Privilege Vulnerability
vendor_msrc·2022-12-13·CVSS 7.8
CVE-2022-44683 [HIGH] Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
A domain user could use this vulnerability to elevate privileges to SYSTEM assigned integrity level.
Windows Kernel: Windows Kernel
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5021237
Reference: https://support.microsoft.com/help/5021237
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5021233
Reference: https://support.microsoft.com/help/5021233
Reference: https://catalog.update.microsoft.com/v
Project0
The Windows Registry Adventure #7: Attack surface analysis - Project Zero
project_zero·2025-05-01
CVE-2010-0237 The Windows Registry Adventure #7: Attack surface analysis - Project Zero
Posted by Mateusz Jurczyk, Google Project Zero
In the first three blog posts of this series, I sought to outline what the Windows Registry actually is, its role, history, and where to find further information about it. In the subsequent three posts, my goal was to describe in detail how this mechanism works internally – from the perspective of its clients (e.g., user-mode applications running on Windows), the regf format used to encode hives, and finally the kernel itself, which contains its canonical implementation. I believe all these elements are essential for painting a complete picture of this subsystem, and in a way, it shows my own approach to security research. One could say that going through this tedious process of getting to know the target unnecessarily lengthens the total
Project0
The Windows Registry Adventure #1: Introduction and research results - Project Zero
project_zero·2024-04-01
CVE-2022-34707 The Windows Registry Adventure #1: Introduction and research results - Project Zero
Posted by Mateusz Jurczyk, Google Project Zero
In the 20-month period between May 2022 and December 2023, I thoroughly audited the Windows Registry in search of local privilege escalation bugs. It all started unexpectedly: I was in the process of developing a coverage-based Windows kernel fuzzer based on the Bochs x86 emulator (one of my favorite tools for security research: see Bochspwn, Bochspwn Reloaded, and my earlier font fuzzing infrastructure), and needed some binary formats to test it on. My first pick were PE files: they are very popular in the Windows environment, which makes it easy to create an initial corpus of input samples, and a basic fuzzing harness is equally easy to develop with just a single GetFileVersionInfoSizeW API call. The test was successful: even though I h
GHSA
GHSA-59gq-gvhq-969m: Windows Kernel Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-12-13
CVE-2022-44683 [HIGH] CWE-416 GHSA-59gq-gvhq-969m: Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability.
No detection rules found.
No public exploits indexed.
Checkpoint
19th December – Threat Intelligence Report
blogs_checkpoint·2022-12-20
CVE-2022-44673 19th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th December, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
Information of more than 80,000 security professionals and law enforcement officers is being offered for sale online, after the FBI’s information sharing portal InfraGard has been breached. The attacker has gained access to InfraGard after applying to join the platform impersonating a financial corporation’s CEO, then usi
Talos
Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-12-13·CVSS 8.5
CVE-2022-41076 [HIGH] Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 48 vulnerabilities. Of these vulnerabilities, 6 are classified as “Critical”, 41 are classified as “Important”, with the remaining vulnerability classified as “Moderate.”
One of the critical vulnerabilities, which Microsoft considers to be “more likely” to be exploited is CVE-2022-41076, a remote code execution (RCE) vulnerability in Windows PowerShell which could allow a previously authenticated attacker to escape the PowerShell Remoting Session Configuration and run unauthorized commands on compromised systems.
Another critical vulnerability, CVE-2022-41127, affects Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central. Successful exploitation could allow an attacker to execute code on Dynamic NAV server
Talos
Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-12-13·CVSS 8.5
CVE-2022-41076 [HIGH] Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for December 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 48 vulnerabilities. Of these vulnerabilities, 6 are classified as “Critical”, 41 are classified as “Important”, with the remaining vulnerability classified as “Moderate.”
One of the critical vulnerabilities, which Microsoft considers to be “more likely” to be exploited is CVE-2022-41076 , a remote code execution (RCE) vulnerability in Windows PowerShell which could allow a previously authenticated attacker to escape the PowerShell Remoting Session Configuration and run unauthorized commands on compromised systems.
Another critical vulnerability, CVE-2022-41127 , affects Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Ce
Crowdstrike
December 2022 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] December 2022 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2022-12-13
Published