CVE-2022-21971VulnerabilityPublished 08/18/2022Updated 10/24/2026

CVE-2022-21971: Microsoft Windows Runtime Remote Code Execution Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 08/18/2022
KEV deadline: 09/08/2022
EPSS: 53.8% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2022-21971 is a high-severity remote code execution vulnerability in Microsoft Windows Runtime. It allows an attacker to execute arbitrary code remotely. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

Microsoft Windows Runtime contains an unspecified vulnerability (CVE-2022-21971) that enables remote code execution. The details of the vulnerability are not specified, but it has been confirmed as exploited in the wild. No vendor advisory or patch information is provided in the input data.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerability is actively exploited in the wild, increasing the risk to unpatched systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, apply standard security best practices such as restricting network access to vulnerable systems and monitoring for suspicious activity related to Windows Runtime components.

Weaknesses

CWE-824Access of Uninitialized Pointer (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:05:51 UTC

Weaknesses

References

Related threats