CVE-2022-21971

CVE-2022-21971 is a remote code execution flaw in the Microsoft Windows Runtime caused by access to an uninitialized pointer (CWE-824). It is triggered locally: an attacker must convince a user (no privileges required) to open or run a specially crafted application or file, which then corrupts memory through the Windows Runtime component. Successful exploitation lets the attacker execute arbitrary code in the context of the affected user, with impacts to confidentiality, integrity, and availability at that user's privilege level, so any user of an affected Windows release is a potential target. Affected products include Windows 10 versions 1809 through 21H2, Windows 11 21H2, and Windows Server 2019, 2022, and 20H2. The flaw is confirmed as exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-18 — and EPSS assigns it a 53.9% probability of exploitation within 30 days (99th percentile), though no public PoC or specific ransomware use is documented.

What to do: Apply Microsoft's security updates addressing CVE-2022-21971 (fixed in the January 2022 Patch Tuesday cumulative updates) to all Windows 10 1809–21H2, Windows 11 21H2, and Windows Server 2019/2022/20H2 systems, prioritizing endpoints used to open untrusted files and any servers on aged builds. Confirm remediation by checking that the relevant cumulative update is installed on each host. Until patched, warn users against opening files or apps from untrusted sources and watch for suspicious child-process activity tied to user-initiated file opens, since exploitation requires user interaction.