CVE-2022-41125

CVE-2022-41125 is an elevation of privilege vulnerability (an out-of-bounds write, CWE-787) in the Windows CNG Key Isolation Service. A local attacker who already has the ability to execute low-privileged code on a vulnerable Windows system can trigger the flaw without user interaction. Successful exploitation grants the attacker elevated (SYSTEM-level) privileges, giving high confidentiality, integrity and availability impact on the host. The flaw affects a broad range of Windows 10, Windows 11, Windows 8.1 and Windows Server versions, meaning nearly the entire mainstream Windows installed base is in scope. It is being actively exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-11-08 and was one of six actively exploited zero-days fixed in Microsoft's November 2022 Patch Tuesday release.

What to do: Apply the November 2022 Windows security updates (or any later cumulative update) from Microsoft per the vendor's instructions, and prioritize this patch since the flaw is confirmed actively exploited. Inventory endpoints and servers running the affected Windows 10, 11, 8.1 and Server 2012/2016 versions and verify each has received the November 2022 or newer cumulative update. No public exploit details or mitigations are published, so patching is the primary remediation; treat any unpatched host as at elevated risk.