CVE-2022-41128
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
Description
CVE-2022-41128 is a remote code execution vulnerability in the Windows Scripting Languages component caused by an out-of-bounds write flaw. This high-severity vulnerability allows a remote attacker to execute arbitrary code on affected Microsoft Windows systems by luring a user to visit a specially crafted website or open a malicious file. The vulnerability affects all supported Windows versions from Windows 7 through Windows 11 and corresponding server editions. CVE-2022-41128 has been confirmed as actively exploited in the wild by CISA, with an EPSS score of 39.82% indicating a very high probability of exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19567 |
| microsoft | windows 10 1607 | < 10.0.14393.5501 |
| microsoft | windows 10 1809 | < 10.0.17763.3650 |
| microsoft | windows 10 20h2 | < 10.0.19042.2251 |
| microsoft | windows 10 21h1 | < 10.0.19043.2251 |
| microsoft | windows 10 21h2 | < 10.0.19044.2251 |
| microsoft | windows 10 22h2 | < 10.0.19045.2251 |
| microsoft | windows 11 21h2 | < 10.0.22000.1219 |
| microsoft | windows 11 22h2 | < 10.0.22621.819 |
| microsoft | windows 7 | sp1 |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5501 |
| microsoft | windows server 2019 | < 10.0.17763.3650 |
| microsoft | windows server 2022 | < 10.0.20348.1249 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41128(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In CVE-2022-41128, the out-of-bounds write vulnerability exists within the Windows scripting engine (JScript9), where processing of specially crafted content triggers improper memory writes beyond allocated buffer boundaries. This memory corruption in the scripting engine allows an attacker to achieve remote code execution in the context of the current user.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2022-41128 carries a CVSS v3.1 score of 8.8 (High severity), reflecting a critical remote code execution vulnerability with extensive impact. Attack Vector (Network): The vulnerability is remotely exploitable over the network, typically through a malicious website or document that triggers the scripting engine vulnerability without requiring physical access. Attack Complexity (Low): Exploitation is straightforward and does not require specialized conditions, race windows, or advanced techniques. Privileges Required (None): No authentication or prior access to the target system is needed. User Interaction (Required): A victim must visit a malicious web page or open a crafted document for the exploit to trigger. Confidentiality, Integrity, and Availability (all High): Successful exploitation allows full code execution in the context of the current user, potentially enabling data theft, system modification, and service disruption. The EPSS score of 39.82% (97th percentile) indicates a very high probability of active exploitation, placing this vulnerability among the most likely to be exploited. Given the confirmed active exploitation and the broad attack surface across all Windows versions, CVE-2022-41128 poses a severe risk to organizations with unpatched systems.
Exploit Maturity
Active exploitation of CVE-2022-41128 has been confirmed by CISA, which added this Windows scripting engine remote code execution vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2022. The EPSS score of 39.82% (97th percentile) represents one of the highest exploitation probabilities observed, indicating that this vulnerability is being widely targeted. While the ransomware association is listed as Unknown, the remote code execution capability combined with confirmed active exploitation makes this vulnerability highly attractive to a broad range of threat actors, from state-sponsored groups to cybercriminal operations. Organizations should treat this as an urgent patching priority.
Remediation
- Apply Microsoft security updates immediately as directed by the vendor advisory at the Microsoft Security Response Center. CISA mandates federal agencies apply mitigations by December 9, 2022, or discontinue use of the affected product.
- Patch all affected Windows versions, including Windows 7, Windows 8.1, Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Prioritize internet-facing systems and endpoints used for web browsing.
- Implement web content filtering and browser isolation to reduce exposure to malicious web content that could trigger the scripting engine vulnerability. Configure web proxies to block access to known malicious domains and implement browser isolation for high-risk browsing activities.
- Monitor for indicators of compromise including unusual script execution, unexpected child processes spawned by browser or Office applications, and network connections to suspicious command-and-control infrastructure. Deploy EDR solutions configured to detect scripting engine exploitation.
- Consider disabling JScript in Internet Explorer through Group Policy if legacy browser usage cannot be eliminated. Configure modern browsers as the default and restrict access to Internet Explorer where possible to reduce the scripting engine attack surface.
Technical Details
CVE-2022-41128 exploits an out-of-bounds write vulnerability (CWE-787) in the Windows JScript9 scripting engine, which processes JavaScript in Internet Explorer and other Windows components that rely on the scripting runtime. The vulnerability occurs when the scripting engine improperly handles objects in memory during content rendering, allowing crafted JavaScript to corrupt memory by writing beyond allocated buffer boundaries. With a Network Attack Vector and Low Attack Complexity, an attacker can host malicious content on a web server and wait for victims to visit the page, requiring only User Interaction and No Privileges on the target. The out-of-bounds write enables the attacker to gain control of instruction pointers or overwrite function tables, achieving arbitrary code execution in the security context of the current user. If the victim has administrator privileges, the attacker gains full system control, making this vulnerability particularly dangerous in environments where users browse the web with elevated privileges.
Frequently Asked Questions
Is CVE-2022-41128 being actively exploited?
Yes, CVE-2022-41128 is being actively exploited in the wild. CISA has confirmed active exploitation and added this vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 39.82% (97th percentile) indicates an extremely high probability of exploitation, making this one of the most actively targeted vulnerabilities.
What products are affected by CVE-2022-41128?
CVE-2022-41128 affects Microsoft Windows 7, Windows 8.1, Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Any system running the affected scripting engine components is vulnerable.
How do I fix CVE-2022-41128?
Apply the latest security updates from Microsoft through the Microsoft Security Response Center advisory. Prioritize patching internet-facing systems and endpoints used for web browsing. Additionally, implement web content filtering and consider disabling JScript in Internet Explorer through Group Policy to reduce the attack surface.
How severe is CVE-2022-41128?
CVE-2022-41128 has a CVSS v3.1 score of 8.8 (High severity) with complete impact across confidentiality, integrity, and availability. The EPSS score of 39.82% places it in the 97th percentile, indicating near-certain active exploitation. The combination of remote code execution capability and confirmed exploitation makes this a critical-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.