CVE-2022-21882

HIGH7.0

CISA KEV

Published 2022-01-11 · Updated 2026-08-15 · Source secure@microsoft.com

Description

Win32k Elevation of Privilege Vulnerability

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787CWE-787

CISA Known-Exploited Vulnerability

Product: Microsoft — Win32k

Name: Microsoft Win32k Privilege Escalation Vulnerability

Date added: 2022-02-04 · Due: 2022-02-18

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-95814
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
2026-09-22 · score 8.1
CVE-2026-94450
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.
2026-09-22 · score 7.5
CVE-2026-91018
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
2026-09-22 · score 8.8
CVE-2026-67615
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.
2026-09-22 · score 8.8
CVE-2026-88419
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
2026-09-22 · score 8.8