Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

7.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

6.40 %

Predictive Probability

Percentile Rank

91.0 th

Documented as more likely to be exploited than 91.0% of known CVEs.

Detection Date

Mar 28, 2022

Remediation Due

Apr 21, 2022

CISA Catalog Active

Threat Analysis

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

Remediation Directive

Apply updates per vendor instructions.

External Intelligence

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2010-4398