CVE-2022-32230 is a null pointer dereference vulnerability in Microsoft Windows SMBv3, affecting Windows 10, 11, and Server 2019. An unauthenticated attacker can trigger a Blue Screen of Death (BSOD) and system reboot on Domain Controllers, or an authenticated attacker on other systems, by sending a malformed SMBv3 request over a named pipe. With a CVSS score of 7.5 (High) and an EPSS score indicating higher exploitability than 96% of CVEs, this flaw poses a significant availability risk. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered some community discussion and media coverage, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* | ||
21h1CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:* | ||
21h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:*:* | ||
1809CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.