CVE-2022-21971: Windows Runtime use-after-free leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in the CISA KEV catalog with confirmed exploitation and a very high EPSS score, though the local vector and user-interaction requirement limit mass remote exploitation.

What it is

CVE-2022-21971 is a remote code execution flaw in the Windows Runtime component of supported Windows 10, Windows 11 and Windows Server builds. The CVSS vector indicates a local attack with a user-interaction requirement, and the CWE-824 tag points to access of an uninitialized pointer as the underlying weakness. It matters because Microsoft patched it and CISA added it to the Known Exploited Vulnerabilities catalog, so exploitation has occurred in the wild.

Impact

A successful attacker can execute arbitrary code in the context of the affected process, giving high confidentiality, integrity and availability impact. Because the vector is local with user interaction, the practical gain is code execution on a victim's machine after they open or interact with crafted content.

Attack surface

The CVSS vector AV:L/AC:L/PR:N/UI:R means the flaw is reached locally with no privileges required but requires the victim to perform an action such as opening a crafted file or handling malicious content. No remote network vector and no authentication requirement are indicated by the record.

Exploitation

CISA added this CVE to the KEV catalog on 2022-08-18 with a remediation due date of 2022-09-08, confirming known exploitation. EPSS gives a 30-day probability of 0.53934 (98.9th percentile), indicating high predicted exploitation activity; the record does not list known ransomware use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all listed Windows 10, Windows 11 and Windows Server versions.
• Prioritize patching internet-facing and user-workstation systems, since KEV status confirms active exploitation.
• Enforce attachment and file-type controls at email and web gateways to reduce delivery of crafted content that triggers the flaw.
• Restrict execution of untrusted files and apply least privilege so code execution does not gain administrative rights.

Detection

• Monitor for unexpected child processes spawned by Windows Runtime or related host processes on patched and unpatched endpoints.
• Alert on suspicious file opens or document handling that immediately precedes process creation or script interpreter launches.
• Hunt for known exploitation artifacts using the MSRC advisory and CISA KEV guidance, and review endpoint telemetry for anomalous code execution in user sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.