CVE-2022-21881: Windows Kernel Elevation of Privilege Vulnerability

CVE-2022-21881 is an elevation of privilege vulnerability in Windows Kernel, rated Important by Microsoft, with a CVSS 3.1 base score of 7 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 24.52% probability of exploitation activity in the next 30 days, higher than 98% of all scored vulnerabilities. Microsoft released the fix on 11 January 2022 in the January 2022 Patch Tuesday, delivered through 9 security updates (KB5009557, KB5009545, KB5009543, KB5009555 and more). It affects 32 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-21881

Severity

High CVSS 7

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

More Likely

Weakness

CWE-362

EPSS

24.52% (percentile 98%)

CISA KEV

Not listed

Released

11 January 2022

Last updated

11 January 2022

Patch Tuesday

January 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-21881 at 7 (temporal 6.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products (32)

Windows

ESU

Security updates (9)

• KB5009557 (Security Update)
• KB5009545 (Security Update)
• KB5009543 (Security Update)
• KB5009555 (Security Update)
• KB5009566 (Security Update)
• KB5009585 (Security Update)
• KB5009546 (Security Update)
• KB5009624 (Monthly Rollup)
• KB5009595 (Security Only)

Exploitation and detection

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

• theabysslabs/CVE-2022-21881 · 21 stars

NIST NVD data

NVD status

Modified

NVD CVSS

7 (HIGH)

NVD weakness

CWE-362

Published to NVD

11 January 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21881
• http://packetstormsecurity.com/files/168097/Race-Against-The-Sandbox.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21881

Acknowledgments

• HuanGMz@KnownSec 404 Team
• Kunlun lab (https://www.cyberkl.com) via TianfuCup (https://www.tianfucup.com)
• sunglin@KnownSec 404 Team
• Tongqing Zhu@KnownSec 404 Team
• Hcamael@KnownSec 404 Team
• Zhiniang Peng @edwardzpeng & Byzero with Sangfor

Revision history

Related vulnerabilities

Other Windows Kernel vulnerabilities

• CVE-2026-96129: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-96052: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-96031: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-95988: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-94514: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7, November 2026)
• CVE-2026-122183: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-119868: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7, November 2026)
• CVE-2026-114170: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-112973: Windows Kernel Security Feature Bypass Vulnerability (High, CVSS 7.1, November 2026)
• CVE-2026-112805: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 8.8, November 2026)
• CVE-2026-112802: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-112790: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7, November 2026)

More from the January 2022 Patch Tuesday

• CVE-2013-3900: WinVerifyTrust Signature Validation Vulnerability (Medium, CVSS 5.5, exploited)
• CVE-2022-21882: Win32k Elevation of Privilege Vulnerability (High, CVSS 7, exploited)
• CVE-2022-21919: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-21836: Windows Certificate Spoofing Vulnerability (High, CVSS 7.8)
• CVE-2022-21874: Windows Security Center API Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-21885: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21897: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21908: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21914: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21916: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: January 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-21881
• NIST NVD: CVE-2022-21881
• CVE.org record: CVE-2022-21881