Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of initialized or uninitialized memory in the process heap.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user open a specially crafted file.
In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file., In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.
An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.
Security updates
10.0.17763.2928 — https://support.microsoft.com/help/5013941
10.0.18363.2274 — https://support.microsoft.com/help/5013945
10.0.19043.1706 — https://support.microsoft.com/help/5013942
10.0.20348.707 — https://support.microsoft.com/help/5013944
10.0.22000.675 — https://support.microsoft.com/help/5013943
10.0.10240.19297 — https://support.microsoft.com/help/5013963
10.0.14393.5125 — https://support.microsoft.com/help/5013952
6.1.7601.25954 — https://support.microsoft.com/help/5014012
6.1.7601.25954 — https://support.microsoft.com/help/5013999
6.3.9600.20371 — https://support.microsoft.com/help/5014011
6.3.9600.20365 — https://support.microsoft.com/help/5014001
6.3.9600.20367 — https://support.microsoft.com/help/5014025
6.0.6003.21481 — https://support.microsoft.com/help/5014010
6.0.6003.21481 — https://support.microsoft.com/help/5014006
6.2.9200.23714 — https://support.microsoft.com/help/5014017
6.2.9200.23714 — https://support.microsoft.com/help/5014018
Vulnerabilities 1
-
Medium 6.5
Windows Graphics Component Information Disclosure Vulnerability
Windows Graphics Component Information Disclosure Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-29112 Windows Graphics Component Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29112
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss