Read the docs
TI-2022-21989 Aliases CVE-2022-44684GHSA-7hmh-8wxq-x9fc

Windows Local Session Manager (LSM) Denial of Service Vulnerability

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Windows Local Session Manager (LSM) Denial of Service Vulnerability

Why it matters now

EPSS 0.01538 75th percentileScored 2026-11-07
Fix Fixed Windows 10 Version 21H1 (Microsoft): 10.0.19043.2364Windows Server 2022 (Microsoft): 10.0.20348.1366+6 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows 10 Version 21H110.0.0 to before 10.0.19043.236410.0.19043.2364Patch availableCNA
MicrosoftWindows Server 202210.0.20348.0 to before 10.0.20348.136610.0.20348.1366Patch availableCNA
MicrosoftWindows 10 Version 20H210.0.0 to before 10.0.19042.236410.0.19042.2364Patch availableCNA
MicrosoftWindows 11 version 21H210.0.0 to before 10.0.22000.133510.0.22000.1335Patch availableCNA
MicrosoftWindows 10 Version 21H210.0.19043.0 to before 10.0.19044.236410.0.19044.2364Patch availableCNA
MicrosoftWindows 11 version 22H210.0.22621.0 to before 10.0.22621.99310.0.22621.993Patch availableCNA
MicrosoftWindows 10 Version 22H210.0.19045.0 to before 10.0.19045.236410.0.19045.2364Patch availableCNA
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)10.0.25398.0 to before 10.0.25398.100910.0.25398.1009Patch availableCNA
  • Windows 10 Version 21H1 VendorMicrosoft Affected 10.0.0 to before 10.0.19043.2364 Fixed in 10.0.19043.2364 Patch available CNA
  • Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.1366 Fixed in 10.0.20348.1366 Patch available CNA
  • Windows 10 Version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19042.2364 Fixed in 10.0.19042.2364 Patch available CNA
  • Windows 11 version 21H2 VendorMicrosoft Affected 10.0.0 to before 10.0.22000.1335 Fixed in 10.0.22000.1335 Patch available CNA
  • Windows 10 Version 21H2 VendorMicrosoft Affected 10.0.19043.0 to before 10.0.19044.2364 Fixed in 10.0.19044.2364 Patch available CNA
  • Windows 11 version 22H2 VendorMicrosoft Affected 10.0.22621.0 to before 10.0.22621.993 Fixed in 10.0.22621.993 Patch available CNA
  • Windows 10 Version 22H2 VendorMicrosoft Affected 10.0.19045.0 to before 10.0.19045.2364 Fixed in 10.0.19045.2364 Patch available CNA
  • Windows Server 2022, 23H2 Edition (Server Core installation) VendorMicrosoft Affected 10.0.25398.0 to before 10.0.25398.1009 Fixed in 10.0.25398.1009 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*before 10.0.19042.2364VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*before 10.0.19043.2364VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*before 10.0.19044.2364VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*before 10.0.19045.2364VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*before 10.0.22000.1335VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*before 10.0.22621.993VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:* Versions before 10.0.19042.2364 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:* Versions before 10.0.19043.2364 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* Versions before 10.0.19044.2364 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* Versions before 10.0.19045.2364 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* Versions before 10.0.22000.1335 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* Versions before 10.0.22621.993 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Windows 10 Version 21H1 (Microsoft) Fixed in 10.0.19043.2364
  • Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.1366
  • Fix · CNA Windows 10 Version 20H2 (Microsoft) Fixed in 10.0.19042.2364
  • Fix · CNA Windows 11 version 21H2 (Microsoft) Fixed in 10.0.22000.1335
  • Fix · CNA Windows 10 Version 21H2 (Microsoft) Fixed in 10.0.19044.2364
  • Fix · CNA Windows 11 version 22H2 (Microsoft) Fixed in 10.0.22621.993
  • Fix · CNA Windows 10 Version 22H2 (Microsoft) Fixed in 10.0.19045.2364
  • Fix · CNA Windows Server 2022, 23H2 Edition (Server Core installation) (Microsoft) Fixed in 10.0.25398.1009

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-44684
  2. 2026-10-03 Alias added: GHSA-7hmh-8wxq-x9fc

References

Patch 1

  • TI-2021-11386 HTTP Protocol Stack Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-08061 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2022-19649 Windows Scripting Languages Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2022-10154 Active Directory Domain Services Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2021-17496 Microsoft MSHTML Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2021-13550 Windows Print Spooler Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences