CVE-2022-21882Disclosure(microsoft / windows_10_1809)

MEDIUMCVSS 7.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft windows_10_1809 systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Win32k Elevation of Privilege Vulnerability

microsoft CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-02-18. Apply updates per vendor instructions.

Patch / fix

Vendor / third-party advisories

http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21882

Weakness type (CWE)

CWE-787

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1809
windows_10_1909
windows_10_20h2
windows_10_21h1

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-06-27); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

windows_10_1809windows_10_1909windows_10_20h2windows_10_21h1windows_10_21h2windows_11_21h2windows_server_2019windows_server_2022windows_server_20h2

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

Patch

125.0%

Active Exploitation

125.0%

Referenced assets1 URL

By indicator

https://www.sentinelone.com/vulnerability-database/cve-2022-21882/

Classification over time

Date	Total	Labels

2026-06-13	1	Disclosure1
2026-06-27	2	Disclosure1Patch1
2026-08-15	1	Active Exploitation1

Full discourse4 posts

OS Dev@OSdev_136d
Disclosure
Windows NT kernel bug CVE-2022-21882 - https://www.sentinelone.com/vulnerability-database/cve-2022-21882/ The vulnerability abuses a use-after-free in "win32k.sys". By carefully manipulating window objects and their lifetime, an attacker can make the kernel operate on a freed object that is now under attacker control. This primitive is then used to achieve arbitrary kernel read/write and finally swap the current process token with the SYSTEM token.
Post summary
The post outlines the technical details of CVE‑2022‑21882, describing a use‑after‑free in win32k.sys that permits kernel read/write and token elevation, without mentioning PoC, exploitation, patch or active attacks.
012073373.6K
4.7K followersView on X
OS Dev@OSdev_122d
Disclosure
CVE-2022-21882 is a Windows kernel privilege escalation vulnerability in win32k. The root cause is a window object type confusion. During a user-mode callback, the kernel failed to revalidate a "tagWND" object after its type was changed, allowing attackers to build powerful memory corruption primitives and ultimately elevate privileges to SYSTEM. It's an excellent case study in Win32k internals, "tagWND", user-mode callbacks, and object type validation.
Post summary
The text provides a technical disclosure of CVE-2022-21882, a Windows kernel privilege escalation vulnerability caused by a type confusion in win32k that permits memory corruption and elevation to SYSTEM.
38059253.0K
4.8K followersView on X
kokumօtօ@__kokumoto73d
Active Exploitation
10件の脆弱性でランサムウェアによる悪用が確認された。米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性が更新。対象は以下。 - CVE-2025-60710 (Windows) - CVE-2020-29574 (CyberoamOS) - CVE-2020-0618 (SQL Server) - CVE-2021-4034 (polkit) - CVE-2016-0189 (IE) - CVE-2022-21882 (Windows) - CVE-2019-5591 (FortiOS) - CVE-2019-0803 (Windows) - CVE-2018-0802 (Office) - CVE-2020-0968 (IE)
Post summary
CISA reports that ransomware actors are actively exploiting ten CVEs spanning Windows, Office, IE, and other platforms.
01121102.7K
7.8K followersView on X
OS Dev@OSdev_122d
Patch
https://www.sentinelone.com/vulnerability-database/cve-2022-21882/
Post summary
The page serves as a patch announcement, offering detailed vulnerability information and indicating that remediation is available.
00020293
4.8K followersView on X

CPE platform detail10 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

10 of 10 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_1909	-	-	-
OS	microsoft	windows_10_20h2	-	-	-
OS	microsoft	windows_10_21h1	-	-	-
OS	microsoft	windows_10_21h2	-	-	-
OS	microsoft	windows_11_21h2	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_20h2	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1809 vulnerabilities

What researchers are saying

CVE-2022-21882

OS Dev[verified]@OSdev_Disclosure

The post outlines the technical details of CVE‑2022‑21882, describing a use‑after‑free in win32k.sys that permits kernel read/write and token elevation, without mentioning PoC, exploitation, patch or active attacks.

OS Dev[verified]@OSdev_Disclosure

The text provides a technical disclosure of CVE-2022-21882, a Windows kernel privilege escalation vulnerability caused by a type confusion in win32k that permits memory corruption and elevation to SYSTEM.

kokumօtօ[verified]@__kokumotoActive Exploitation

CISA reports that ransomware actors are actively exploiting ten CVEs spanning Windows, Office, IE, and other platforms.

OS Dev[verified]@OSdev_Patch

The page serves as a patch announcement, offering detailed vulnerability information and indicating that remediation is available.