Skip to content
OpenAdvisories
High MSRC-CVE-2022-26934 1 CVE

Windows Graphics Component Information Disclosure Vulnerability

Published May 10, 2022 · Updated Jul 12, 2022 · Revision 2

Vendor: Microsoft

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of initialized or uninitialized memory in the process heap.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user open a specially crafted file.
In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file., In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.
An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.

Security updates
10.0.17763.2928 — https://support.microsoft.com/help/5013941
10.0.18363.2274 — https://support.microsoft.com/help/5013945
10.0.19043.1706 — https://support.microsoft.com/help/5013942
10.0.20348.707 — https://support.microsoft.com/help/5013944
10.0.22000.675 — https://support.microsoft.com/help/5013943
10.0.10240.19297 — https://support.microsoft.com/help/5013963
10.0.14393.5125 — https://support.microsoft.com/help/5013952
6.1.7601.25954 — https://support.microsoft.com/help/5014012
6.1.7601.25954 — https://support.microsoft.com/help/5013999
6.3.9600.20371 — https://support.microsoft.com/help/5014011
6.3.9600.20365 — https://support.microsoft.com/help/5014001
6.3.9600.20367 — https://support.microsoft.com/help/5014025
6.0.6003.21481 — https://support.microsoft.com/help/5014010
6.0.6003.21481 — https://support.microsoft.com/help/5014006
6.2.9200.23714 — https://support.microsoft.com/help/5014017
6.2.9200.23714 — https://support.microsoft.com/help/5014018
16.63.22070801 — https://go.microsoft.com/fwlink/p/?linkid=831049
https — https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates

Vulnerabilities 1

Revision history

  1. #2

    In the Security Updates table, added the following versions of Microsoft Office as they also affected by CVE-2022-26934: Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for Mac, and Microsoft Office LTSC for Mac 2021. Microsoft strongly recommends that customers running any of these versions of Office install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  2. #1

    Information published.

References