CVE-2022-30149: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVE-2022-30149 is a remote code execution vulnerability in Windows Lightweight Directory Access Protocol (LDAP), rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.97% probability of exploitation activity in the next 30 days, higher than 80% of all scored vulnerabilities. Microsoft released the fix on 14 June 2022 in the June 2022 Patch Tuesday, delivered through 15 security updates (KB5014692, KB5014699, KB5014678, KB5014677 and more). It affects 39 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-30149

Severity

High CVSS 7.5

Microsoft severity

Important

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

1.97% (percentile 80%)

CISA KEV

Not listed

Released

14 June 2022

Last updated

14 June 2022

Patch Tuesday

June 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-30149 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious LDAP server using their LDAP client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's LDAP client application.

Affected products (39)

Windows

ESU

Security updates (15)

• KB5014692 (Security Update)
• KB5014699 (Security Update)
• KB5014678 (Security Update)
• KB5014677 (Security Hotpatch Update)
• KB5014697 (Security Update)
• KB5014710 (Security Update)
• KB5014702 (Security Update)
• KB5014748 (Monthly Rollup)
• KB5014742 (Security Only)
• KB5014738 (Monthly Rollup)
• KB5014746 (Security Only)
• KB5014752 (Monthly Rollup)
• KB5014743 (Security Only)
• KB5014747 (Monthly Rollup)
• KB5014741 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

7.5 (HIGH)

Published to NVD

15 June 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30149
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30149 (Patch, Vendor Advisory)

Acknowledgments

• Yuki Chen with Cyber KunLun

Revision history

Related vulnerabilities

Other Windows Lightweight Directory Access Protocol (LDAP) vulnerabilities

• CVE-2026-34339: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (Medium, CVSS 5.5, May 2026)
• CVE-2026-21243: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (High, CVSS 7.5, February 2026)
• CVE-2025-29954: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (Medium, CVSS 5.9, May 2025)
• CVE-2025-27469: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (High, CVSS 7.5, April 2025)
• CVE-2025-26673: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (High, CVSS 7.5, April 2025)
• CVE-2025-26663: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.1, April 2025)
• CVE-2025-21376: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.1, February 2025)
• CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (Critical, CVSS 9.8, December 2024)
• CVE-2024-49127: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.1, December 2024)
• CVE-2024-49121: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (High, CVSS 7.5, December 2024)
• CVE-2024-49113: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (High, CVSS 7.5, December 2024)
• CVE-2024-21356: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (Medium, CVSS 6.5, February 2024)

More from the June 2022 Patch Tuesday

• CVE-2022-30136: Windows Network File System Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-30147: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30160: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-30153: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2022-30161: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2022-30165: Windows Kerberos Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-30163: Windows Hyper-V Remote Code Execution Vulnerability (High, CVSS 8.5)
• CVE-2022-30141: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2022-22018: HEVC Video Extensions Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-29111: HEVC Video Extensions Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-29119: HEVC Video Extensions Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-30131: Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: June 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-30149
• NIST NVD: CVE-2022-30149
• CVE.org record: CVE-2022-30149