CVE-2022-38044

What it actually does

The vulnerability is classified as remote code execution but has a local, user-interaction attack shape: an unauthenticated attacker must convince a user or system process to open or mount attacker-controlled media/content that is parsed by the Windows CD-ROM File System driver. Successful exploitation can cause memory corruption in a kernel-mode component, allowing attacker-controlled code to execute with high privileges and resulting in compromise of confidentiality, integrity, and availability. The supplied affected-product metadata also references Linux libsepol packages, which appears inconsistent with the Windows CD-ROM driver title; organizations should validate both the Microsoft advisory mapping and any Linux distribution package advisories before scoping exposure.

Why it matters to the business

Successful exploitation could let an attacker take full control of an affected endpoint after a user interacts with malicious removable-media or disc-image content, enabling data theft, malware installation, lateral movement, or system disruption. Although it is not listed in CISA KEV and no exploit maturity is provided, the EPSS score is elevated at approximately 56%, so security teams should treat exposure as meaningful, especially on user workstations, jump hosts, engineering systems, and environments where ISO files, removable media, or downloaded disk images are commonly handled. The inconsistent Linux package metadata may also create operational risk if teams rely on only one inventory source, so patch validation should cover both OS-level Microsoft updates and any listed libsepol packages where they are actually present.

How an attack unfolds

An attacker prepares malicious CD-ROM filesystem content, such as a crafted disc image or removable-media artifact, designed to trigger the vulnerable parsing path in the filesystem driver. The attacker then delivers it through a phishing email, download link, shared file repository, removable media, or another social-engineering channel. When a user opens, mounts, previews, or otherwise causes the operating system to process the malicious content, the vulnerable driver parses the crafted filesystem structures. If exploitation succeeds, memory corruption occurs in kernel context and the attacker gains code execution with high privileges. From there, the attacker can deploy persistence, disable security controls, collect credentials, access local data, and move laterally using the compromised host as a foothold.

How to fix it

Apply the relevant Microsoft security update or cumulative update for the affected Windows versions that remediates CVE-2022-38044, prioritizing endpoints and servers that can process removable media or mounted disc images. Where the supplied Linux distribution metadata is applicable, update libsepol to the fixed package versions: Ubuntu Pro 16.04 LTS: 2.4-2ubuntu0.1~esm1; Ubuntu 18.04 LTS: 2.7-1ubuntu0.1; Ubuntu 20.04 LTS: 3.0-1ubuntu0.1; Ubuntu 22.04 LTS: 3.3-1; Debian 12: 3.3-1; Debian 13: 3.3-1. If immediate patching is not possible, reduce exposure by restricting automatic mounting of removable media and disc images, blocking untrusted ISO/IMG attachments at email and web gateways, limiting removable-media use, enforcing least privilege, and ensuring endpoint protection monitors file mounting and suspicious child processes after archive or image-file access.

How to confirm the fix worked

Confirm Windows remediation by checking that the applicable Microsoft cumulative update level for the affected OS build is installed and that vulnerable systems are no longer missing the vendor security update. Validate Linux package remediation, where relevant, by checking installed package versions with package-manager commands such as `dpkg -l libsepol*` or `apt-cache policy libsepol1` and confirming the installed version is equal to or newer than the fixed version for the distribution release. Test exposure controls by verifying that untrusted ISO/IMG files are blocked or warned on at email, web, and endpoint layers; removable-media restrictions are enforced; and endpoint telemetry records mount events. Confirm that vulnerability scanners and configuration-management inventories no longer report the affected versions after patch deployment and reboot where required.

Typical attack path

1. Identify users or systems likely to open ISO files, optical-media images, removable-media content, or downloaded software bundles.
2. Create or obtain a malicious disc image or media artifact crafted to trigger the vulnerable CD-ROM filesystem parsing behavior.
3. Deliver the artifact through phishing, file-sharing platforms, removable media, compromised websites, or software distribution channels.
4. Induce the user to open, mount, preview, or otherwise process the malicious content.
5. Trigger kernel-mode memory corruption in the vulnerable filesystem driver.
6. Execute attacker-controlled code with high privileges on the affected endpoint.
7. Establish persistence, collect credentials or sensitive files, and use the endpoint for lateral movement or further payload deployment.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry for suspicious disc-image or removable-media activity followed by abnormal high-privilege execution. Useful sources include Windows Security logs, Sysmon, EDR process and file telemetry, PowerShell logs, Microsoft Defender events, device-control logs, removable-media audit logs, shellbag and recent-file artifacts, mounted-device registry artifacts, and email/web gateway records for ISO/IMG delivery. Look for users receiving or downloading ISO, IMG, or other optical-media images from untrusted sources, followed shortly by mount events, crashes involving filesystem or storage drivers, unexpected child processes launched from mounted volumes, creation of persistence mechanisms, credential-dumping activity, or security-control tampering. Investigate mounted volumes with unusual labels, files with Mark-of-the-Web from the Internet Zone, and process trees where archive tools, browsers, mail clients, or file managers are followed by execution from a mounted image. On Linux systems where the libsepol package metadata is applicable, detection should focus on whether vulnerable package versions remain installed rather than exploitation of the Windows driver behavior.

• cdfs.sys
• cdrom.sys
• \\Device\\CdRom
• \\Device\\CdRom0
• Microsoft-Windows-Kernel-PnP
• Microsoft-Windows-DriverFrameworks-UserMode/Operational
• .iso
• .img
• .udf
• Zone.Identifier
• Mark-of-the-Web
• AutoPlay
• AutoRun
• MountedDevices
• HKLM\\SYSTEM\\MountedDevices
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2
• libsepol1
• 2.4-2ubuntu0.1~esm1
• 2.7-1ubuntu0.1
• 3.0-1ubuntu0.1
• 3.3-1

What your security team should do

• Prioritize patching affected Windows endpoints that commonly handle downloaded software, ISO/IMG files, removable media, or user-supplied files.
• Resolve the metadata discrepancy by cross-checking Microsoft advisories, Linux distribution advisories, package inventories, and vulnerability scanner findings before declaring systems in or out of scope.
• Deploy or tune controls to block or quarantine untrusted ISO, IMG, and optical-media image files from email and web downloads where business processes allow.
• Disable or restrict AutoRun/AutoPlay and unnecessary removable-media mounting across managed endpoints.
• Hunt for recent mounting or opening of unusual disc-image files followed by suspicious process creation, privilege escalation, security-tool tampering, or persistence changes.
• Validate that endpoint detection and response tools collect file creation, image mounting, process creation, driver activity, and removable-media events.
• Because the EPSS score is elevated, track this vulnerability in accelerated remediation workflows even though it is not currently listed in CISA KEV.