Skip to content
OpenAdvisories
High MSRC-CVE-2022-26928 1 CVE

Windows Photo Import API Elevation of Privilege Vulnerability

Published Sep 13, 2022 · Updated Sep 4, 2023 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Security updates
10.0.17763.4131 — https://support.microsoft.com/help/5023702
10.0.19043.2006 — https://support.microsoft.com/help/5017308
10.0.20348.1726 — https://support.microsoft.com/help/5026370
10.0.20348.1724 — https://support.microsoft.com/help/5026456
10.0.22000.1936 — https://support.microsoft.com/help/5026368
10.0.19044.2965 — https://support.microsoft.com/help/5026361
10.0.10240.19805 — https://support.microsoft.com/help/5023713
10.0.14393.5786 — https://support.microsoft.com/help/5023697

Vulnerabilities 1

Revision history

  1. #3

    Updated the links to the Windows Update Catalog. This is an informational change only.

  2. #2

    To comprehensively address CVE-2022-26928, Microsoft has released May 2023 security updates for all affected versions of Microsoft Windows. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  3. #1

    Information published.

References