CVE-2022-32230 json
SMBv3 FileNormalizedNameInformation NULL Pointer Dereference
published 2022-06-14 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-53430
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.9%
- EPSS 7.9% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.
Patch / fix
- Microsoft Windows 10 Version 20H2 19043.1706
Exploit prediction
7.93% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- rapid7.com https://www.rapid7.com/blog/post/2022/06/14/cve-2022-32230-windows-smb-denial-of-service-vulnerability-fixed/ referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/zeroSteiner/metasploit-framework/blob/feat/mod/cve-2022-32230/modules/auxiliary/dos/smb/smb_filenormalizednameinformation.rb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- Microsoft Windows 10 Version 20H2
- Microsoft Windows Server Version 20H2
- Microsoft Windows 10 Version 21H1
- Microsoft Windows 10 Version 21H2
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
-
msrc.microsoft.com
/update-guide/vulnerability/CVE-2022-32230
patch, vendor-advisory
-
support.microsoft.com
/en-us/topic/may-10-2022-kb5013942-os-builds-19042-1706-19043-1706-and-19044-1706-60b51119-85be-4a34-9e21-8954
patch, vendor-advisory
-
rapid7.com
/blog/post/2022/06/14/cve-2022-32230-windows-smb-denial-of-service-vulnerability-fixed/
exploit, third-party-advisory
-
github.com
/zeroSteiner/metasploit-framework/blob/feat/mod/cve-2022-32230/modules/auxiliary/dos/smb/smb_filenormalizednam
exploit, third-party-advisory
Sources
- CVE List CVE-2022-32230
- NVD CVE-2022-32230
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.