CVE-2022-40733 — An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643

Back Back to CVE browser

MEDIUM

An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643

Published Dec 18, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.83%

Description

An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service.

Affected products

Vendor Microsoft Product Windows Default
n/a
- Version
  Build 22000.593
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows

n/a

Version	Status	Constraints
Build 22000.593	affected	-

Remediation

No remediation recorded yet.

Metrics

0.83% 0.00828

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00828

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (4 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.83% (0.00828)	55.94th	v5 (v2026.06.15)
Jun 15, 2026	0.80% (0.00802)	51.67th	v5 (v2026.06.15)
Mar 17, 2025	0.08% (0.00082)	21.73th	v4 (v2025.03.14)
Dec 19, 2024	0.04% (0.00043)	10.88th	v3 (v2023.03.01)