CVE-2022-22037: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVE-2022-22037 is an elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC), rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.56% probability of exploitation activity in the next 30 days, higher than 85% of all scored vulnerabilities. Microsoft released the fix on 12 July 2022 in the July 2022 Patch Tuesday, delivered through 14 security updates (KB5015811, KB5015807, KB5015827, KB5015814 and more). It affects 39 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-22037

Severity

High CVSS 7.5

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

2.56% (percentile 85%)

CISA KEV

Not listed

Released

12 July 2022

Last updated

12 July 2022

Patch Tuesday

July 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-22037 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (39)

Windows

ESU

Security updates (14)

• KB5015811 (Security Update)
• KB5015807 (Security Update)
• KB5015827 (Security Update)
• KB5015814 (Security Update)
• KB5015832 (Security Update)
• KB5015808 (Security Update)
• KB5015861 (Monthly Rollup)
• KB5015862 (Security Only)
• KB5015874 (Monthly Rollup)
• KB5015877 (Security Only)
• KB5015866 (Monthly Rollup)
• KB5015870 (Security Only)
• KB5015863 (Monthly Rollup)
• KB5015875 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

7.5 (HIGH)

Published to NVD

12 July 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22037
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22037

Acknowledgments

• Jarvis_1oop

Revision history

Related vulnerabilities

Other Windows Advanced Local Procedure Call (ALPC) vulnerabilities

• CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited, September 2026)
• CVE-2023-28216: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7, April 2023)
• CVE-2023-21674: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 8.8, exploited, January 2023)
• CVE-2022-41100: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2022)
• CVE-2022-41093: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2022)
• CVE-2022-41045: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2022)
• CVE-2022-30224: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-30202: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-30160: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8, June 2022)

More from the July 2022 Patch Tuesday

• CVE-2022-22047: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-30216: Windows Server Service Tampering Vulnerability (High, CVSS 8.8)
• CVE-2022-22034: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30220: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30215: Active Directory Federation Services Elevation of Privilege Vulnerability (High, CVSS 7.5)
• CVE-2022-22026: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-30221: Windows Graphics Component Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2022-30222: Windows Shell Remote Code Execution Vulnerability (High, CVSS 8.4)
• CVE-2022-22029: Windows Network File System Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2022-22038: Remote Procedure Call Runtime Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2022-22024: Windows Fax Service Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-22027: Windows Fax Service Remote Code Execution Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: July 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-22037
• NIST NVD: CVE-2022-22037
• CVE.org record: CVE-2022-22037