CVE-2022-41073
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Description
CVE-2022-41073 is an elevation of privilege vulnerability in the Windows Print Spooler service caused by an out-of-bounds write weakness. This flaw allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access on affected Microsoft Windows systems. The vulnerability affects a broad range of Windows versions from Windows 7 through Windows 11 and all corresponding server editions. CVE-2022-41073 has been confirmed as actively exploited in the wild by CISA and is associated with ransomware campaigns, continuing the trend of Print Spooler vulnerabilities being targeted by threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19567 |
| microsoft | windows 10 1607 | < 10.0.14393.5501 |
| microsoft | windows 10 1809 | < 10.0.17763.3650 |
| microsoft | windows 10 20h2 | < 10.0.19042.2251 |
| microsoft | windows 10 21h1 | < 10.0.19043.2251 |
| microsoft | windows 10 21h2 | < 10.0.19044.2251 |
| microsoft | windows 10 22h2 | < 10.0.19045.2251 |
| microsoft | windows 11 21h2 | < 10.0.22000.1219 |
| microsoft | windows 11 22h2 | < 10.0.22621.819 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5501 |
| microsoft | windows server 2019 | < 10.0.17763.3650 |
| microsoft | windows server 2022 | < 10.0.20348.1249 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41073(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In CVE-2022-41073, the out-of-bounds write vulnerability exists within the Windows Print Spooler service, where improper memory handling allows an attacker to write data beyond allocated buffer boundaries. This memory corruption can be leveraged to execute arbitrary code with elevated privileges in the context of the Print Spooler service, which runs as SYSTEM.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2022-41073 carries a CVSS v3.1 score of 7.8 (High severity), reflecting a serious local privilege escalation with complete system compromise potential. Attack Vector (Local): The attacker must have local access to the target system, meaning initial access through another vector such as phishing or a separate vulnerability is required. Attack Complexity (Low): Once local access is obtained, exploitation is straightforward with no special conditions needed. Privileges Required (Low): Only standard user-level privileges are needed to trigger the vulnerability, making it accessible to any authenticated user. User Interaction (None): No additional user action is required beyond the attacker's own actions. Confidentiality, Integrity, and Availability (all High): Successful exploitation grants SYSTEM-level access, enabling the attacker to read all data on the system, modify or install programs, and fully control system availability. The EPSS score of 2.54% (85th percentile) indicates elevated exploitation probability, and the confirmed association with ransomware campaigns makes this vulnerability a critical concern for organizations running unpatched Windows systems.
Exploit Maturity
Active exploitation of CVE-2022-41073 has been confirmed by CISA, which added this Print Spooler privilege escalation to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2022. Public exploit code is available for CVE-2022-41073 via Packet Storm Security, lowering the barrier to exploitation significantly. This vulnerability has been associated with ransomware operations, where attackers use it to escalate from initial low-privilege access to full SYSTEM control. The EPSS score of 2.54% (85th percentile) reflects a meaningful probability of exploitation, consistent with the availability of public exploit code and confirmed active campaigns.
Remediation
- Apply Microsoft security updates immediately as specified in the vendor advisory at the Microsoft Security Response Center. CISA mandates that federal agencies apply mitigations by December 9, 2022, or discontinue use of the affected product.
- Patch all affected Windows versions, including Windows 7, Windows 8.1, Windows 10 (all versions from 1507 through 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Prioritize systems that are internet-facing or accessible to multiple users.
- Restrict Print Spooler service access by disabling the Print Spooler on systems where printing is not required, particularly on domain controllers and servers. Use Group Policy to manage Print Spooler service configurations across the environment.
- Monitor for privilege escalation indicators by reviewing Windows Event Logs for unusual service creation, process execution as SYSTEM from unexpected parent processes, and anomalous Print Spooler activity. Deploy endpoint detection and response (EDR) solutions to detect exploitation attempts.
- Implement least-privilege principles by ensuring standard users do not have unnecessary local administrator rights, and apply application whitelisting to prevent unauthorized executables from running even if privilege escalation is achieved.
Technical Details
CVE-2022-41073 is rooted in an out-of-bounds write condition (CWE-787) within the Windows Print Spooler service, a long-standing component responsible for managing print jobs across the operating system. The vulnerability occurs when the Print Spooler improperly handles memory operations, allowing a crafted request to write data beyond the boundaries of an allocated buffer. With a Local Attack Vector and Low Attack Complexity, a locally authenticated user with Low Privileges can trigger the memory corruption without any additional user interaction. The out-of-bounds write enables the attacker to overwrite critical memory structures, ultimately achieving arbitrary code execution in the context of the SYSTEM account. This follows a pattern of Print Spooler vulnerabilities including the well-known PrintNightmare series, where the privileged nature of the spooler service makes it an attractive target for privilege escalation attacks.
Frequently Asked Questions
Is CVE-2022-41073 being actively exploited?
Yes, CVE-2022-41073 is being actively exploited in the wild. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog. Public exploit code is available on Packet Storm Security, and the vulnerability has been linked to ransomware campaigns.
What products are affected by CVE-2022-41073?
CVE-2022-41073 affects a wide range of Microsoft Windows systems including Windows 7, Windows 8.1, Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022.
How do I fix CVE-2022-41073?
Apply the latest security updates from Microsoft through the Microsoft Security Response Center advisory. Additionally, disable the Print Spooler service on systems where printing is not needed, especially domain controllers and critical servers. Monitor for signs of exploitation using EDR solutions.
How severe is CVE-2022-41073?
CVE-2022-41073 has a CVSS v3.1 score of 7.8 (High severity) with complete impact on confidentiality, integrity, and availability. The EPSS score of 2.54% (85th percentile) indicates elevated exploitation likelihood, and the confirmed ransomware association further elevates the practical risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.