Vulnerability record · CVE-2022-38044 · published 11 October 2022
CVE-2022-38044: Windows CD-ROM File System Driver remote code execution
Microsoft · Windows 10
CVE-2022-38044 is a remote code execution flaw in the Windows CD-ROM File System Driver (CDFS). Microsoft rates it high severity, and because the driver parses filesystem structures, a crafted image or volume can corrupt memory in a way that leads to code execution. The record gives no root-cause detail beyond the driver name and no affected version breakdown.
Description
Windows CD-ROM File System Driver Remote Code Execution Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityHigh CVSS severity (7.8) and a 99th-percentile EPSS score warrant prompt patching, though local access and user interaction lower the immediate risk compared with network-exploitable flaws.
What it is
CVE-2022-38044 is a remote code execution flaw in the Windows CD-ROM File System Driver (CDFS). Microsoft rates it high severity, and because the driver parses filesystem structures, a crafted image or volume can corrupt memory in a way that leads to code execution. The record gives no root-cause detail beyond the driver name and no affected version breakdown.
Impact
An attacker who gets the crafted input processed gains code execution in the context of the affected Windows component, with high confidentiality, integrity and availability impact per the CVSS vector. The scope is unchanged, so the compromise is limited to the vulnerable driver's security context.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker must get a crafted CD-ROM image or volume mounted or opened on the target, typically via a file the user opens or inserts. It is not reachable over the network directly.
Exploitation
CISA KEV does not list this CVE, and the only references are Microsoft's advisory and patch pages with no exploit or proof-of-concept tags. EPSS is high at 0.56269 (99th percentile), indicating elevated predicted exploitation activity, but the record confirms no observed exploitation.
What to do
- Apply the Microsoft security update for CVE-2022-38044 on all affected Windows versions, including the older client and server releases listed.
- Restrict or block mounting of untrusted CD-ROM/ISO images and removable media on sensitive endpoints where feasible.
- Enforce Mark-of-the-Web and SmartScreen/Attachment Manager policies so downloaded images are handled as untrusted.
- Reduce the attack surface by disabling or restricting the CDFS driver where optical media is not required.
- Track patch compliance for the affected Windows 7 through Windows 11 and Server 2008 through 2022 builds.
Detection
- Monitor for unexpected crashes or faults in the CDFS driver (cdfs.sys) via Windows Error Reporting or crash dumps.
- Alert on processes mounting or opening ISO/optical image files from user-writable or download directories.
- Review endpoint telemetry for suspicious child processes spawned shortly after image mount or file-open events.
- Audit patch state of the CDFS-related update across the affected Windows versions to find unpatched hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-38044 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-38044), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
