CVE-2022-50238

Description

The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.

CVSS v3.1 Score

7.4

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-820 CWE-820

CWE-184 CWE-184

References

Other References

https://github.com/wdormann/applywdac https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules

Frequently Asked Questions

What is CVE-2022-50238? +

The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues. It has a CVSS v3.1 base score of 7.4 (HIGH).

How severe is CVE-2022-50238? +

CVE-2022-50238 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2022-50238? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-47154 9.0

LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing …

CVE-2026-53277 8.8

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks …

CVE-2024-49114 7.8

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2026-53153 7.8

In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears …

CVE-2025-1445 7.5

A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an …

CVE-2025-47999 6.8

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.