Security readout for executives and security teams
Plain-English summary
This Windows flaw lets an attacker who already has limited local access raise privileges through the CNG Key Isolation Service. Successful exploitation could compromise sensitive data, system integrity, and availability. Because CISA lists it as known exploited, affected systems should be patched promptly.
Executive priority
Treat as a high-priority remediation because exploitation is documented and successful abuse can enable broad system compromise. Accelerate patching on high-value servers, shared workstations, and systems where untrusted users may obtain local access. This is urgent, but the evidence does not support describing it as remotely exploitable or critical severity.
Technical view
CVE-2022-41125 is a CWE-787 out-of-bounds write in the Windows CNG Key Isolation Service. CVSS 3.1 rates it 7.8: local access and low privileges are required, with no user interaction. Successful exploitation can substantially affect confidentiality, integrity, and availability.
Likely exposure
Exposure spans listed versions of Windows 8.1, Windows 10, Windows 11, and Windows Server 2012 through 2022, including several Server Core installations. Systems missing Microsoft's applicable security update remain the primary concern. The supplied sources do not identify configuration-specific prerequisites beyond local, low-privileged access.
Exploitation context
CISA KEV status supports that this vulnerability has been exploited in the wild. The supplied evidence does not establish exploitation volume, attribution, campaign targets, public exploit availability, or whether exploitation remains widespread. Because exploitation requires local access, it is particularly relevant after an attacker gains an initial foothold or valid low-privileged account.
Researcher notes
The vector is AV:L/AC:L/PR:L/UI:N/S:U with high confidentiality, integrity, and availability impact. CWE-787 indicates an out-of-bounds write. The bundle does not provide root-cause details, affected functions, exploit mechanics, indicators, or release-specific KB identifiers; obtain those only from current vendor guidance without assuming undocumented behavior.
Mitigation direction
- Apply Microsoft's applicable security update for each affected Windows release.
- Prioritize systems accessible to untrusted users or already showing signs of compromise.
- Upgrade or isolate unsupported Windows releases if an applicable update cannot be obtained.
- Consult current Microsoft guidance for release-specific update and servicing requirements.
Validation and detection
- Inventory endpoints and servers against the affected Windows releases listed by Microsoft.
- Verify the applicable Microsoft security update is installed and successfully applied.
- Confirm unsupported or unpatchable systems have documented isolation and access restrictions.
- Review endpoint telemetry for unexplained privilege escalation; the supplied sources provide no specific indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-41125 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2022-41125 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2022-11-08T00:00:00.000Z: CVE-2022-41125 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41125CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.