CVE-2022-40732

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Dec 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-407336.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Wind CVE-2022-407346.5UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary CVE-2022-407357.5The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, beca CVE-2022-407366.5An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp.CVE-2022-407376.5An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located CVE-2022-407386.5An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descri CVE-2022-407395.4Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject Jav CVE-2022-407407.2Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this CVE-2022-407419.8Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this v CVE-2022-407426.5Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execut CVE-2022-407436.1Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scr CVE-2022-407445.4IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in