PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-23282 Microsoft CVE debrief

CVE-2022-23282 is a Microsoft Paint 3D vulnerability published on 2022-03-09 and rated 7.8 High by NVD. The available CVSS vector indicates local exploitation that requires user interaction, with no privileges needed and high impact to confidentiality, integrity, and availability. The public record identifies Microsoft Paint 3D as vulnerable and links to Microsoft’s security advisory for additional vendor guidance.

Vendor
Microsoft
Product
Paint 3D
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-03-09
Original CVE updated
2024-11-21
Advisory published
2022-03-09
Advisory updated
2024-11-21

Who should care

Organizations that allow Paint 3D to be installed or used on managed Windows endpoints should care, especially desktop support, endpoint security, and vulnerability management teams. Users who open untrusted files or content in Paint 3D are the most relevant exposure group.

Technical summary

NVD lists the vulnerable product as microsoft:paint_3d and assigns CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means exploitation is expected to be local, low complexity, requires user interaction, and can have severe impact if successful. The public metadata does not provide exploit details, so defensive interpretation should stay limited to the recorded attack characteristics and vendor advisory linkage.

Defensive priority

High for endpoint fleets that include Paint 3D, but not a top-tier internet-exposed emergency based on the published vector. Prioritize if the application is installed on many user workstations or if your environment regularly handles untrusted files.

Recommended defensive actions

  • Inventory endpoints that have Microsoft Paint 3D installed.
  • Apply Microsoft security updates or remediation guidance referenced by the vendor advisory.
  • Restrict or remove Paint 3D where it is not needed.
  • Warn users against opening untrusted files or content in Paint 3D.
  • Monitor for vendor follow-up updates and verify remediation across managed devices.

Evidence notes

This debrief is based on the supplied NVD metadata, which includes the CVE publish/modify timestamps, the vulnerable CPE for microsoft:paint_3d, and the CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Microsoft’s advisory URL is referenced in the source metadata, but the page content was not supplied here, so no additional vendor-specific claims are included. The title describes the issue as a remote code execution vulnerability, while the CVSS vector suggests local, user-interaction-required exploitation; this summary follows the structured CVSS evidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-23282 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-23282

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-23282 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23282

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.