PatchSiren cyber security CVE debrief

CVE-2022-41103 Microsoft CVE debrief

CVE-2022-41103 is a Microsoft Word information disclosure vulnerability with a CVSS 3.1 score of 5.5 (MEDIUM severity). Published on November 9, 2022, this vulnerability affects multiple Microsoft Office and SharePoint products where local attack vectors could lead to unauthorized information disclosure. The vulnerability requires user interaction and has low attack complexity, with no privileges required for exploitation. Microsoft addressed this vulnerability through their security update guidance. The vulnerability was last modified in the NVD on May 19, 2026, indicating ongoing record maintenance. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Microsoft
Product: Microsoft SharePoint Server 2019
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2022-11-09
Original CVE updated: 2026-05-19
Advisory published: 2022-11-09
Advisory updated: 2026-05-19

Who should care

Organizations running affected Microsoft Office and SharePoint deployments, particularly those with document-centric workflows. Security teams should prioritize patching for environments handling sensitive documents. End users in enterprise environments with managed Office installations should ensure updates are applied through their organization's patch management systems.

Technical summary

This information disclosure vulnerability in Microsoft Word (CVE-2022-41103) allows a local attacker to potentially access sensitive information through user interaction with a malicious document. The vulnerability affects Word 2013 SP1 (including RT), Word 2016, Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office Online Server, Office Web Apps Server 2013 SP1, and multiple SharePoint Server versions (2013 SP1, 2016, 2019, Subscription Edition). The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates local attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality impact with no integrity or availability impact. Microsoft has released security updates to address this vulnerability.

Defensive priority

medium

Recommended defensive actions

Apply Microsoft security updates for affected Office and SharePoint products via Microsoft Update or WSUS
For Microsoft 365 Apps, ensure automatic updates are enabled or manually update to the latest channel build
For on-premises SharePoint servers, apply the specific security update referenced in Microsoft security guidance
Review and restrict document handling from untrusted sources to reduce exposure to user-interaction attack vectors
Monitor Microsoft Security Response Center communications for any supplementary guidance

Evidence notes

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Affected products confirmed through NVD CPE criteria. CWE classified as NVD-CWE-noinfo. Last NVD modification: 2026-05-19.

Official resources

Microsoft disclosed this vulnerability on November 9, 2022, as part of their monthly security update release. The vulnerability affects Word 2013 SP1, Word 2016, Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021, and multiple