Read the docs
TI-2022-19342 Aliases CVE-2022-40708GHSA-2g39-c72r-5g49

Out-of-bounds read in Trend Micro Deep Security

Priority LOW 15CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Trend MicroTrend Micro Deep Security20—No fix listedCNA
  • Trend Micro Deep Security VendorTrend Micro Affected 20 Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:trendmicro:deep_security_agent:20.0:-:*:*:long_term_support:*:*:*20.0VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1337:*:*:long_term_support:*:*:*20.0 update1337VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1559:*:*:long_term_support:*:*:*20.0 update1559VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update158:*:*:long_term_support:*:*:*20.0 update158VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update167:*:*:long_term_support:*:*:*20.0 update167VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1681:*:*:long_term_support:*:*:*20.0 update1681VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update173:*:*:long_term_support:*:*:*20.0 update173VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update180:*:*:long_term_support:*:*:*20.0 update180VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update182:*:*:long_term_support:*:*:*20.0 update182VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1822:*:*:long_term_support:*:*:*20.0 update1822VulnerableTrendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:-:*:*:long_term_support:*:*:* Versions 20.0 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1337:*:*:long_term_support:*:*:* Versions 20.0 update1337 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1559:*:*:long_term_support:*:*:* Versions 20.0 update1559 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update158:*:*:long_term_support:*:*:* Versions 20.0 update158 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update167:*:*:long_term_support:*:*:* Versions 20.0 update167 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1681:*:*:long_term_support:*:*:* Versions 20.0 update1681 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update173:*:*:long_term_support:*:*:* Versions 20.0 update173 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update180:*:*:long_term_support:*:*:* Versions 20.0 update180 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update182:*:*:long_term_support:*:*:* Versions 20.0 update182 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1822:*:*:long_term_support:*:*:* Versions 20.0 update1822 Vulnerable ·Trendmicro
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update183:*:*:long_term_support:*:*:*20.0 update183VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1876:*:*:long_term_support:*:*:*20.0 update1876VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update190:*:*:long_term_support:*:*:*20.0 update190VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update198:*:*:long_term_support:*:*:*20.0 update198VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2009:*:*:long_term_support:*:*:*20.0 update2009VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update208:*:*:long_term_support:*:*:*20.0 update208VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update213:*:*:long_term_support:*:*:*20.0 update213VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2204:*:*:long_term_support:*:*:*20.0 update2204VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update223:*:*:long_term_support:*:*:*20.0 update223VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update224:*:*:long_term_support:*:*:*20.0 update224VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2419:*:*:long_term_support:*:*:*20.0 update2419VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2593:*:*:long_term_support:*:*:*20.0 update2593VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2740:*:*:long_term_support:*:*:*20.0 update2740VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2921:*:*:long_term_support:*:*:*20.0 update2921VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3165:*:*:long_term_support:*:*:*20.0 update3165VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3288:*:*:long_term_support:*:*:*20.0 update3288VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3445:*:*:long_term_support:*:*:*20.0 update3445VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3530:*:*:long_term_support:*:*:*20.0 update3530VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3771:*:*:long_term_support:*:*:*20.0 update3771VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3964:*:*:long_term_support:*:*:*20.0 update3964VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4185:*:*:long_term_support:*:*:*20.0 update4185VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4416:*:*:long_term_support:*:*:*20.0 update4416VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4726:*:*:long_term_support:*:*:*20.0 update4726VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4959:*:*:long_term_support:*:*:*20.0 update4959VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update5137:*:*:long_term_support:*:*:*20.0 update5137VulnerableTrendmicro
cpe:2.3:a:trendmicro:deep_security_agent:20.0:update877:*:*:long_term_support:*:*:*20.0 update877VulnerableTrendmicro
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update183:*:*:long_term_support:*:*:* Versions 20.0 update183 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update1876:*:*:long_term_support:*:*:* Versions 20.0 update1876 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update190:*:*:long_term_support:*:*:* Versions 20.0 update190 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update198:*:*:long_term_support:*:*:* Versions 20.0 update198 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2009:*:*:long_term_support:*:*:* Versions 20.0 update2009 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update208:*:*:long_term_support:*:*:* Versions 20.0 update208 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update213:*:*:long_term_support:*:*:* Versions 20.0 update213 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2204:*:*:long_term_support:*:*:* Versions 20.0 update2204 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update223:*:*:long_term_support:*:*:* Versions 20.0 update223 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update224:*:*:long_term_support:*:*:* Versions 20.0 update224 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2419:*:*:long_term_support:*:*:* Versions 20.0 update2419 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2593:*:*:long_term_support:*:*:* Versions 20.0 update2593 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2740:*:*:long_term_support:*:*:* Versions 20.0 update2740 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update2921:*:*:long_term_support:*:*:* Versions 20.0 update2921 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3165:*:*:long_term_support:*:*:* Versions 20.0 update3165 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3288:*:*:long_term_support:*:*:* Versions 20.0 update3288 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3445:*:*:long_term_support:*:*:* Versions 20.0 update3445 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3530:*:*:long_term_support:*:*:* Versions 20.0 update3530 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3771:*:*:long_term_support:*:*:* Versions 20.0 update3771 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update3964:*:*:long_term_support:*:*:* Versions 20.0 update3964 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4185:*:*:long_term_support:*:*:* Versions 20.0 update4185 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4416:*:*:long_term_support:*:*:* Versions 20.0 update4416 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4726:*:*:long_term_support:*:*:* Versions 20.0 update4726 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update4959:*:*:long_term_support:*:*:* Versions 20.0 update4959 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update5137:*:*:long_term_support:*:*:* Versions 20.0 update5137 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:deep_security_agent:20.0:update877:*:*:long_term_support:*:*:* Versions 20.0 update877 Vulnerable ·Trendmicro
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40708
  2. 2026-10-03 Alias added: GHSA-2g39-c72r-5g49

References

Advisory 2

  • TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
  • TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
  • TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
See all 603 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences