CVE-2022-41125: Windows CNG Key Isolation Service out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a HIGH-severity local privilege-escalation flaw confirmed as exploited in the wild via CISA KEV, though it requires an existing foothold and has a relatively low EPSS probability.

What it is

The Windows CNG Key Isolation Service (KeyIso) contains an out-of-bounds write (CWE-787) that allows a local user to elevate privileges. Microsoft rates it 7.8 HIGH, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being used in real attacks. It affects a broad set of Windows 10, Windows 11, Windows 8.1 and Windows Server releases.

Impact

An attacker who already has a low-privileged foothold on a host can write out of bounds in the KeyIso service and gain full control of confidentiality, integrity and availability, effectively SYSTEM-level access. That access is typically used to disable defenses, dump credentials or move laterally.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already be able to run code on the machine. It is not reachable remotely over the network and does not require a victim to open a file or click anything.

Exploitation

CISA added it to KEV on 2022-11-08 with a remediation due date of 2022-12-09, confirming active exploitation; EPSS is 0.03021 (86.8th percentile), and no ransomware campaign use is recorded. No public exploit code is referenced in the supplied references.

What to do

• Apply the Microsoft security update for CVE-2022-41125 to all affected Windows 10, Windows 11, Windows 8.1 and Windows Server versions as the first action.
• Prioritize patching of internet-facing and high-value hosts, and treat the CISA KEV due date of 2022-12-09 as the deadline.
• Restrict local interactive logon and code execution rights so untrusted users cannot run code on sensitive endpoints.
• Monitor and limit use of the CNG Key Isolation Service where business needs allow, and audit for unexpected service crashes or restarts.
• Hunt for post-exploitation behavior on unpatched hosts, since this flaw is used as a privilege-escalation step rather than an initial access vector.

Detection

• Alert on unexpected crashes or restarts of the KeyIso (CNG Key Isolation) service, which can indicate exploitation attempts.
• Monitor for processes that spawn from or interact with lsass.exe or other privileged services shortly after a low-privileged process starts.
• Correlate local privilege-escalation indicators, such as new SYSTEM-level processes or token manipulation, on hosts that have not applied the November 2022 updates.
• Track patch compliance for CVE-2022-41125 across the listed Windows builds and flag unpatched endpoints for follow-up.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.