The Windows Registry Adventure #1: Introduction and research results
Summary: Google Project Zero's Mateusz Jurczyk audited the Windows Registry over a 20-month period from May 2022 to December 2023, filing 39 bug reports that Microsoft fixed as 44 CVEs, with an average of 81 days from report to fix. A further 20 low- or unclear-impact issues were reported between November 2023 and January 2024, of which Microsoft fixed 6 in a March 2024 bulletin and closed 14 as WontFix, bringing the total to 50 CVEs.
What you should know: Jurczyk rated more than half of the findings as easy or moderate to exploit for information disclosure or local privilege escalation, and developed working exploits for CVE-2022-34707 and CVE-2023-23420 that elevate to SYSTEM on Windows 11.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-34707CVE-2022-34708CVE-2022-35768
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026