CVE-2022-21882: Microsoft Win32k out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable, actively exploited elevation-of-privilege flaw with KEV listing and very high EPSS, though it requires existing local access.

What it is

CVE-2022-21882 is an out-of-bounds write (CWE-787) in the Windows Win32k component that allows a local user to elevate privileges. Microsoft rates it 7.8 HIGH, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is a real, actively used escalation path rather than a theoretical bug.

Impact

An attacker who already has code execution as a low-privileged local user can gain SYSTEM-level privileges, enabling full control of the host and use as a foothold for lateral movement or ransomware deployment.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it is reached by running code on the target machine, not over the network. No remote or unauthenticated path is described.

Exploitation

CISA KEV lists it as exploited in the wild with known ransomware campaign use, and EPSS is 0.592 (99th percentile), indicating high real-world exploitation activity. A public Packet Storm advisory exists, consistent with exploit code being available.

What to do

• Apply the Microsoft security updates referenced in the MSRC advisory for all listed Windows 10, Windows 11 and Windows Server builds.
• Prioritize patching on endpoints and servers where untrusted users or processes can execute code, per CISA KEV due date.
• Enforce least privilege and remove unnecessary local admin rights to limit the value of an elevation primitive.
• Monitor for and block known exploit tooling and post-exploitation behavior associated with Win32k privilege escalation.

Detection

• Alert on unexpected SYSTEM-level process creation or token manipulation originating from low-privileged user sessions.
• Monitor for known Win32k exploit artifacts and suspicious console/win32k API abuse patterns on unpatched hosts.
• Track patch compliance for the affected Windows builds and flag hosts still missing the January 2022 updates.
• Correlate local privilege escalation events with subsequent credential dumping, service creation or ransomware precursor activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.