CVE-2022-22038: Remote Procedure Call Runtime Remote Code Execution Vulnerability

CVE-2022-22038 is a remote code execution vulnerability in Remote Procedure Call Runtime, rated Critical by Microsoft, with a CVSS 3.1 base score of 8.1 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.52% probability of exploitation activity in the next 30 days, higher than 85% of all scored vulnerabilities. Microsoft released the fix on 12 July 2022 in the July 2022 Patch Tuesday, delivered through 10 security updates (KB5015811, KB5015807, KB5015827, KB5015814 and more). It affects 31 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-22038

Severity

High CVSS 8.1

Microsoft severity

Critical

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

2.52% (percentile 85%)

CISA KEV

Not listed

Released

12 July 2022

Last updated

12 July 2022

Patch Tuesday

July 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-22038 at 8.1 (temporal 7.3) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data.

Affected products (31)

Windows

ESU

Security updates (10)

• KB5015811 (Security Update)
• KB5015807 (Security Update)
• KB5015827 (Security Update)
• KB5015814 (Security Update)
• KB5015832 (Security Update)
• KB5015808 (Security Update)
• KB5015874 (Monthly Rollup)
• KB5015877 (Security Only)
• KB5015863 (Monthly Rollup)
• KB5015875 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

8.1 (HIGH)

Published to NVD

12 July 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22038
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22038

Acknowledgments

• Yuki Chen with Cyber KunLun

Revision history

Related vulnerabilities

Other Remote Procedure Call Runtime vulnerabilities

• CVE-2026-118737: Remote Procedure Call Runtime Remote Code Execution Vulnerability (High, CVSS 8.1, November 2026)
• CVE-2024-20678: Remote Procedure Call Runtime Remote Code Execution Vulnerability (High, CVSS 8.8, April 2024)
• CVE-2023-35300: Remote Procedure Call Runtime Remote Code Execution Vulnerability (High, CVSS 8.8, July 2023)
• CVE-2023-35319: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-35318: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-35316: Remote Procedure Call Runtime Information Disclosure Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-35314: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-33173: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-33172: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-33169: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-33168: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)
• CVE-2023-33167: Remote Procedure Call Runtime Denial of Service Vulnerability (Medium, CVSS 6.5, July 2023)

More from the July 2022 Patch Tuesday

• CVE-2022-22047: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-30216: Windows Server Service Tampering Vulnerability (High, CVSS 8.8)
• CVE-2022-22034: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30220: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30215: Active Directory Federation Services Elevation of Privilege Vulnerability (High, CVSS 7.5)
• CVE-2022-30202: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-22026: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-30221: Windows Graphics Component Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2022-30222: Windows Shell Remote Code Execution Vulnerability (High, CVSS 8.4)
• CVE-2022-22029: Windows Network File System Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2022-22024: Windows Fax Service Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-22027: Windows Fax Service Remote Code Execution Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: July 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-22038
• NIST NVD: CVE-2022-22038
• CVE.org record: CVE-2022-22038