CVE-2022-29111 – CVE-2022-29111 is a remote code execution vulne... (How to Fix)

Q: What is the severity of CVE-2022-29111?

CVE-2022-29111 has a CVSS score of 7.8 (HIGH). CVE-2022-29111 is a remote code execution vulnerability in Microsoft's HEVC Video Extensions that allows attackers to execute arbitrary code by tricking users into opening specially crafted video files. This affects Windows systems with the HEVC Video Extensions installed, typically through the Microsoft Store. Users who open malicious video content are at risk.

📋 TL;DR

CVE-2022-29111 is a remote code execution vulnerability in Microsoft's HEVC Video Extensions that allows attackers to execute arbitrary code by tricking users into opening specially crafted video files. This affects Windows systems with the HEVC Video Extensions installed, typically through the Microsoft Store. Users who open malicious video content are at risk.

💻 Affected Systems

Products:

HEVC Video Extensions from Microsoft Store

Versions: Versions prior to the May 2022 update

Operating Systems: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where HEVC Video Extensions are installed. This is an optional component typically installed from Microsoft Store for HEVC video playback support.

📦 What is this software?

Hevc Video Extensions by Microsoft

View all CVEs affecting Hevc Video Extensions →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within networks.

🟠

Likely Case

Local user account compromise when a user opens a malicious video file, allowing attackers to execute code with the user's privileges.

🟢

If Mitigated

Limited impact with proper application whitelisting and user education preventing execution of malicious files.

🌐 Internet-Facing: MEDIUM - Attackers could host malicious videos on websites or send via email, but requires user interaction to open the file.

🏢 Internal Only: MEDIUM - Internal phishing campaigns or shared network drives could distribute malicious videos to multiple users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires user interaction to open a malicious video file. No public exploit code was available at disclosure time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Updated version available through Microsoft Store (May 2022 update)

Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29111

Restart Required: No

Instructions:

1. Open Microsoft Store. 2. Click 'Library' in bottom left. 3. Click 'Get updates' to update all apps. 4. Alternatively, search for 'HEVC Video Extensions' and update directly. 5. Verify update by checking version in Apps & Features.

🔧 Temporary Workarounds

Uninstall HEVC Video Extensions

windows

Remove the vulnerable component entirely if HEVC video playback is not required

Settings > Apps > Apps & features > Search 'HEVC' > Click 'Uninstall'

Disable automatic codec installation

windows

Prevent automatic installation of video codecs that could introduce vulnerabilities

Settings > Apps > Video playback > Disable 'Automatically download codecs for media playback'

🧯 If You Can't Patch

Implement application control policies to block execution of HEVC Video Extensions
Educate users about the risks of opening video files from untrusted sources

🔍 How to Verify

Check if Vulnerable:

Check if HEVC Video Extensions is installed: Settings > Apps > Apps & features > Search 'HEVC'. If installed and not updated after May 2022, system is vulnerable.

Check Version:

Get-AppxPackage -Name *HEVC* | Select-Object Name, Version, InstallLocation

Verify Fix Applied:

Verify HEVC Video Extensions version in Microsoft Store shows latest update or check last modified date in Apps & Features is after May 2022.

📡 Detection & Monitoring

Log Indicators:

Windows Event Logs showing HEVC Video Extensions crashes
Application errors related to hevcdecoderstore.dll

Network Indicators:

Unusual outbound connections after video file execution
Downloads of video files from suspicious sources

SIEM Query:

EventID=1000 AND Source='Application Error' AND (ProcessName LIKE '%HEVC%' OR FaultModuleName LIKE '%hevc%')

📊 Metadata

CVE ID: CVE-2022-29111

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published: June 15, 2022

Last Updated: January 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON