fr Sign in

7.8 High Exploited

CVE-2022-21971 Microsoft Windows Runtime Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-824

Description

Windows Runtime Remote Code Execution Vulnerability

Affected products and versions

Product	Affected versions	Fixed in
Windows 10 Version 1809 10.0	10.0.0 → < 10.0.17763.2565	10.0.17763.2565
Windows Server 2019 10.0	10.0.17763.0 → < 10.0.17763.2565	10.0.17763.2565
Windows Server 2019 (Server Core installation) 10.0	10.0.17763.0 → < 10.0.17763.2565	10.0.17763.2565
Windows 10 Version 1909 10.0	10.0.0 → < 10.0.18363.2094	10.0.18363.2094
Windows 10 Version 21H1 10.0	10.0.0 → < 10.0.19043.1526	10.0.19043.1526
Windows Server 2022 10.0	10.0.20348.0 → < 10.0.20348.524	10.0.20348.524
Windows 10 Version 20H2 10.0	10.0.0 → < 10.0.19042.1526	10.0.19042.1526
Windows Server version 20H2 10.0	10.0.0 → < 10.0.19042.1526	10.0.19042.1526
Windows 11 version 21H2 10.0	10.0.0 → < 10.0.22000.493	10.0.22000.493

Show the other branch

Product	Affected versions	Fixed in
Windows 10 Version 21H2 10.0	10.0.19043.0 → < 10.0.19044.1526	10.0.19044.1526

References

Windows Runtime Remote Code Execution Vulnerability msrc.microsoft.com

Timeline

Published February 9, 2022
Added to the KEV catalogue August 18, 2022
Last modified October 21, 2025

The 5349 CVEs of Windows 10 Version 1809 →

CVE-2026-108471 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to… 8.8 High CVE-2026-108136 Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally 7.8 High CVE-2026-108129 Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network 6.5 Medium CVE-2026-108132 Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally 7.0 High

Track this CVE