Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets.
Yes. Microsoft recommends prioritizing the patching of affected servers.
Windows 10, Version 1909 is not in the Security Updates table. Is it affected by this vulnerability?
No, the vulnerable code does not exist in Windows 10, version 1909. It is not affected by this vulnerability.
No, the registry key is only present in Windows Server 2019 and Windows 10, version 1809.
Security updates
10.0.17763.2452 — https://support.microsoft.com/help/5009557
10.0.19043.1466 — https://support.microsoft.com/help/5009543
10.0.20348.469 — https://support.microsoft.com/help/5009555
10.0.22000.434 — https://support.microsoft.com/help/5009566
Vulnerabilities 1
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
Revision history
-
#2
Clarified the mitigation and added FAQs. These are informational changes only.
-
#1
Information published.
References
-
CVE-2022-21907 HTTP Protocol Stack Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss