CVE-2022-37981
About
Windows Event Logging Service Denial of Service Vulnerability
Rainforest analyst review
The Windows Event Logging Service can be knocked over by this flaw, a denial-of-service that a low-privileged local user can trigger. The impact is availability-only and narrow: no data disclosure, no code execution, no integrity loss, just the ability to disrupt the logging service. The 4.3 is honest about how limited that is.
There is a subtle wrinkle worth noting, degrading event logging is sometimes useful to an attacker trying to blind defenders, but that only matters to someone who already has local access and is mid-operation. It is not a target for remote or opportunistic exploitation, and on its own it accomplishes nothing an attacker cares about. The exploitation tempo for a bug like this is essentially nil.
We rank this at the bottom of the Patch Tuesday batch and let it ride the normal monthly rollup. The one thing worth doing is ensuring log forwarding sends events off-host, so that even if the local logging service is disrupted, our detection coverage doesn't depend on the very service an attacker could stop.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2022-37981?
Windows Event Logging Service Denial of Service Vulnerability
How severe is CVE-2022-37981?
CVE-2022-37981 carries a CVSS 3.1 base score of 4.3, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 50 out of 100, in the elevated band.
How is CVE-2022-37981 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L): attack vector Network, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality None, integrity None and availability Low.
Which products are affected by CVE-2022-37981?
Public advisories list the following as affected: windows 10, windows 11, windows 7, windows 8.1, windows rt 8.1, windows server 2008, +4. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-37981?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.