CVE-2022-38011 - Vulnerability Details

Vendors	Products
Microsoft	Raw Image Extension Windows 10 Windows 11

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011

Type	Values Removed	Values Added
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011

Show plain JSON

{"containers": {"cna": {"title": "Raw Image Extension Remote Code Execution Vulnerability", "datePublic": "2022-09-13T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:raw_image_extension:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.0.0", "versionEndExcluding": "v2.0.32061.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Raw Image Extension", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for HoloLens", "Windows 10 Version 21H1 for x64-based Systems", "Windows 10 Version 21H1 for ARM64-based Systems", "Windows 10 Version 21H1 for 32-bit Systems", "Windows 10 Version 20H2 for 32-bit Systems", "Windows 10 Version 20H2 for ARM64-based Systems", "Windows 11 version 21H2 for x64-based Systems", "Windows 11 version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 for 32-bit Systems", "Windows 10 for x64-based Systems", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems"], "versions": [{"version": "2.1.0.0", "lessThan": "v2.0.32061.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Raw Image Extension Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-03-11T16:10:44.732Z"}, "references": [{"name": "Raw Image Extension Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:37:42.666Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2022-38011", "datePublished": "2022-09-13T18:42:19", "dateReserved": "2022-08-08T00:00:00", "dateUpdated": "2025-03-11T16:10:44.732Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

title : Raw Image Extension Remote Code Execution Vulnerability (string)

datePublic : 2022-09-13T07:00:00.000Z (string)

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:raw_image_extension:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 2.1.0.0 (string)

versionEndExcluding : v2.0.32061.0 (string)

}

]

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Raw Image Extension (string)

platforms : [ »

0 : Windows 10 Version 1809 for 32-bit Systems (string)

1 : Windows 10 Version 1809 for x64-based Systems (string)

2 : Windows 10 Version 1809 for ARM64-based Systems (string)

3 : Windows 10 Version 1809 for HoloLens (string)

4 : Windows 10 Version 21H1 for x64-based Systems (string)

5 : Windows 10 Version 21H1 for ARM64-based Systems (string)

6 : Windows 10 Version 21H1 for 32-bit Systems (string)

7 : Windows 10 Version 20H2 for 32-bit Systems (string)

8 : Windows 10 Version 20H2 for ARM64-based Systems (string)

9 : Windows 11 version 21H2 for x64-based Systems (string)

10 : Windows 11 version 21H2 for ARM64-based Systems (string)

11 : Windows 10 Version 21H2 for 32-bit Systems (string)

12 : Windows 10 Version 21H2 for ARM64-based Systems (string)

13 : Windows 10 Version 21H2 for x64-based Systems (string)

14 : Windows 10 for 32-bit Systems (string)

15 : Windows 10 for x64-based Systems (string)

16 : Windows 10 Version 1607 for 32-bit Systems (string)

17 : Windows 10 Version 1607 for x64-based Systems (string)

]

versions : [ »

0 : { »

version : 2.1.0.0 (string)

lessThan : v2.0.32061.0 (string)

versionType : custom (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

value : Raw Image Extension Remote Code Execution Vulnerability (string)

lang : en-US (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Remote Code Execution (string)

lang : en-US (string)

type : Impact (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-03-11T16:10:44.732Z (string)

}

references : [ »

0 : { »

name : Raw Image Extension Remote Code Execution Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

version : 3.1 (string)

baseSeverity : HIGH (string)

baseScore : 7.3 (number)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:37:42.666Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

assignerShortName : microsoft (string)

cveId : CVE-2022-38011 (string)

datePublished : 2022-09-13T18:42:19 (string)

dateReserved : 2022-08-08T00:00:00 (string)

dateUpdated : 2025-03-11T16:10:44.732Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:raw_image_extension:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BD211DA-89B2-4C91-9F73-20E97F420BE1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "matchCriteriaId": "084984D5-D241-497B-B118-50C6C1EAD468", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "matchCriteriaId": "BA592626-F17C-4F46-823B-0947D102BBD2", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "matchCriteriaId": "610B33F9-0309-4CF7-B7E4-5152D9B2FFE4", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "matchCriteriaId": "21074553-EDF2-468D-8E79-C39851B5BC79", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "matchCriteriaId": "4E62F9CB-D1B6-4B4D-BCCD-7F4D36A73B4D", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "matchCriteriaId": "49A4BBDA-0389-4171-AA49-6837F7DF4454", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "matchCriteriaId": "F8C238FA-B20F-40A5-B861-A8295858F4BE", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "matchCriteriaId": "56513BCA-A9F5-4112-BDE6-77E9B8D2677E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:arm64:*", "matchCriteriaId": "665EA912-D724-41EB-86A9-24EB4FE87B54", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x64:*", "matchCriteriaId": "77E07B96-EAAA-4DD6-9172-0DE98A36726F", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x86:*", "matchCriteriaId": "B846A736-E77C-4665-B28B-4E511880D575", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "matchCriteriaId": "897A48D7-FCA1-4560-AFBB-718AF19BA3A2", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "matchCriteriaId": "507EB48C-F479-424C-8ABA-C279AB4FE3F4", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "matchCriteriaId": "925B8C67-C96F-4A4D-9BE7-CCCD78EF3C31", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "matchCriteriaId": "6CF580BA-6938-40F6-9D86-F43044A6BACA", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "matchCriteriaId": "C5E038AA-514F-48AC-B45E-859EE32525B4", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "B9F64296-66BF-4F1D-A11C-0C44C347E2AC", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "matchCriteriaId": "5D7F7DDB-440E-42CD-82F4-B2C13F3CC462", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Raw Image Extension Remote Code Execution Vulnerability"}, {"lang": "es", "value": "Una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en Raw Image Extension"}], "id": "CVE-2022-38011", "lastModified": "2025-01-02T20:15:58.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2022-09-13T19:15:12.757", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:raw_image_extension:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 9BD211DA-89B2-4C91-9F73-20E97F420BE1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* (string)

matchCriteriaId : 084984D5-D241-497B-B118-50C6C1EAD468 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* (string)

matchCriteriaId : BA592626-F17C-4F46-823B-0947D102BBD2 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* (string)

matchCriteriaId : 610B33F9-0309-4CF7-B7E4-5152D9B2FFE4 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* (string)

matchCriteriaId : 21074553-EDF2-468D-8E79-C39851B5BC79 (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* (string)

matchCriteriaId : 4E62F9CB-D1B6-4B4D-BCCD-7F4D36A73B4D (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:* (string)

matchCriteriaId : 49A4BBDA-0389-4171-AA49-6837F7DF4454 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:* (string)

matchCriteriaId : F8C238FA-B20F-40A5-B861-A8295858F4BE (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:* (string)

matchCriteriaId : 56513BCA-A9F5-4112-BDE6-77E9B8D2677E (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:arm64:* (string)

matchCriteriaId : 665EA912-D724-41EB-86A9-24EB4FE87B54 (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x64:* (string)

matchCriteriaId : 77E07B96-EAAA-4DD6-9172-0DE98A36726F (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x86:* (string)

matchCriteriaId : B846A736-E77C-4665-B28B-4E511880D575 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:* (string)

matchCriteriaId : 897A48D7-FCA1-4560-AFBB-718AF19BA3A2 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:* (string)

matchCriteriaId : 507EB48C-F479-424C-8ABA-C279AB4FE3F4 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:* (string)

matchCriteriaId : 925B8C67-C96F-4A4D-9BE7-CCCD78EF3C31 (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:* (string)

matchCriteriaId : 6CF580BA-6938-40F6-9D86-F43044A6BACA (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:* (string)

matchCriteriaId : C5E038AA-514F-48AC-B45E-859EE32525B4 (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:* (string)

matchCriteriaId : B9F64296-66BF-4F1D-A11C-0C44C347E2AC (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:* (string)

matchCriteriaId : 5D7F7DDB-440E-42CD-82F4-B2C13F3CC462 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Raw Image Extension Remote Code Execution Vulnerability (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de Ejecución de Código Remota en Raw Image Extension (string)

}

]

id : CVE-2022-38011 (string)

lastModified : 2025-01-02T20:15:58.447 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.3 (number)

impactScore : 5.9 (number)

source : secure@microsoft.com (string)

type : Secondary (string)

}

]

}

published : 2022-09-13T19:15:12.757 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38011 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38011 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object