CVE-2022-41128: Windows Scripting Languages Remote Code Execution Vulnerability
First published: Tue Nov 08 2022(Updated: )
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows 10 | =20H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows Server 2008 R2 | ||
| Microsoft Windows Server 2012 R2 | ||
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows 10 | =21H1 | |
| Microsoft Windows 7 | ||
| Microsoft Windows 10 | =21H1 | |
| Microsoft Windows 10 | =21H1 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =20H2 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 7 | ||
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =20H2 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows RT | ||
| Microsoft Windows Server | ||
| Microsoft Windows 8.1 | ||
| Microsoft Windows 8.1 | ||
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =20h2 | |
| Microsoft Windows 10 | =21h1 | |
| Microsoft Windows 10 | =21h2 | |
| Microsoft Windows 10 | =22h2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows 10 | =1809 | |
| Windows 11 | ||
| Windows 11 | =22h2 | |
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows 8.1 | ||
| Microsoft Windows 8.1 | ||
| Microsoft Windows Server | =r2-sp1 | |
| Microsoft Windows Server | ||
| Microsoft Windows Server | =r2 | |
| Microsoft Windows Server 2016 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows Server 2022 | ||
| Microsoft Windows Server 2016 | ||
| Microsoft Windows | ||
| Microsoft Windows Server 2019 | ||
| Windows 11 | =22H2 | |
| Windows 11 | =22H2 | |
| Windows 11 | =21H2 | |
| Windows 11 | =21H2 | |
| Microsoft Windows Server 2022 | ||
| Microsoft Windows 10 | <10.0.10240.19567 | |
| Microsoft Windows 10 | <10.0.14393.5501 | |
| Microsoft Windows 10 | <10.0.17763.3650 | |
| Microsoft Windows 10 | <10.0.19042.2251 | |
| Microsoft Windows 10 | <10.0.19043.2251 | |
| Microsoft Windows 10 | <10.0.19044.2251 | |
| Microsoft Windows 10 | <10.0.19045.2251 | |
| Windows 11 | <10.0.22000.1219 | |
| Windows 11 | <10.0.22621.819 | |
| Microsoft Windows Server 2016 | <10.0.14393.5501 | |
| Microsoft Windows Server 2019 | <10.0.17763.3650 | |
| Microsoft Windows Server 2022 | <10.0.20348.1249 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128 (Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128;
- https://nvd.nist.gov/vuln/detail/CVE-2022-41128
- https://www.bleepingcomputer.com/news/security/malicious-ads-exploited-internet-explorer-zero-day-to-drop-malware/
Frequently Asked Questions
What is CVE-2022-41128?
CVE-2022-41128 is a vulnerability in Microsoft Windows that allows for remote code execution.
Which versions of Microsoft Windows are affected by CVE-2022-41128?
CVE-2022-41128 affects multiple versions of Microsoft Windows, including Windows 10, Windows 11, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2016, Windows 7, Windows 8.1, and Windows Server 2012.
What is the severity of CVE-2022-41128?
The severity of CVE-2022-41128 is critical, with a CVSS score of 8.8.
How can I fix CVE-2022-41128?
To fix CVE-2022-41128, Microsoft has released patches that can be downloaded from the Microsoft Update Catalog or through Windows Update. Please refer to the provided support links for the specific patches for your version of Windows.
Where can I find more information about CVE-2022-41128?
You can find more information about CVE-2022-41128 on the Microsoft Security Response Center website.
- collector/msrc-cve
- agent/type
- exploited/true
- source/Microsoft
- agent/first-publish-date
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/description
- agent/remedy
- agent/author
- agent/references
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-38178
- alias/CVE-2022-41128
- agent/event
- agent/trending
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/cisa-known-exploited
- source/CISA
- agent/title
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- vendor/microsoft
- canonical/microsoft windows 10
- version/microsoft windows 10/20h2
- version/microsoft windows 10/22h2
- version/microsoft windows 10/1607
- canonical/microsoft windows server 2008 r2
- canonical/microsoft windows server 2012 r2
- version/microsoft windows 10/21h2
- version/microsoft windows 10/21h1
- canonical/microsoft windows 7
- version/microsoft windows 10/1809
- canonical/microsoft windows rt
- canonical/microsoft windows server
- canonical/microsoft windows 8.1
- canonical/windows 11
- version/windows 11/22h2
- version/microsoft windows 7/sp1
- version/microsoft windows server/r2-sp1
- version/microsoft windows server/r2
- canonical/microsoft windows server 2016
- canonical/microsoft windows server 2019
- canonical/microsoft windows server 2022
- canonical/microsoft windows
- version/windows 11/21h2