CVE-2022-38003: Windows Resilient File System Elevation of Privilege

CVE-2022-38003 is an elevation of privilege vulnerability in Windows Resilient File System Elevation of Privilege, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.64% probability of exploitation activity in the next 30 days, higher than 51% of all scored vulnerabilities. Microsoft released the fix on 11 October 2022 in the October 2022 Patch Tuesday, delivered through 6 security updates (KB5018419, KB5018410, KB5018421, KB5018418 and more). It affects 23 products in 1 product family (Windows).

Key facts

CVE ID

CVE-2022-38003

Severity

High CVSS 7.8

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

0.64% (percentile 51%)

CISA KEV

Not listed

Released

11 October 2022

Last updated

18 October 2022

Patch Tuesday

October 2022 Patch Tuesday

Product families

Windows

CVSS score and vector

Microsoft scores CVE-2022-38003 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (23)

Windows

Security updates (6)

• KB5018419 (Security Update)
• KB5018410 (Security Update)
• KB5018421 (Security Update)
• KB5018418 (Security Update)
• KB5018411 (Security Update)
• KB5018427 (Security Update)

NIST NVD data

NVD status

Modified

NVD CVSS

7.8 (HIGH)

Published to NVD

11 October 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38003
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38003 (Patch, Vendor Advisory)

Acknowledgments

• k0shl with Kunlun Lab

Revision history

Related vulnerabilities

More from the October 2022 Patch Tuesday

• CVE-2022-41033: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37987: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37989: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37997: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38028: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38050: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38051: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-34689: Windows CryptoAPI Spoofing Vulnerability (High, CVSS 7.5)
• CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability (Medium, CVSS 6.5)
• CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 8.8)

All vulnerabilities of this release: October 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-38003
• NIST NVD: CVE-2022-38003
• CVE.org record: CVE-2022-38003