{"id":"CVE-2022-50238","aliases":["EUVD-2022-55223","GHSA-m379-7mfm-wqr6"],"status":"disputed","title":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online...","description":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00237,"percentile":0.14824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-184","CWE-820"],"published":"2025-09-08T00:00:00Z","modified":"2026-11-10T12:10:00Z","products":[{"vendor":"microsoft","product":"windows"}],"references":[{"url":"https://github.com/wdormann/applywdac"},{"url":"https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50238"},{"url":"https://github.com/advisories/GHSA-m379-7mfm-wqr6"}],"sources":{"cve":[{"id":"CVE-2022-50238","description":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.","status":"disputed","published":"2025-09-08T00:00:00Z","modified":"2025-11-17T16:01:40.773Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-820","CWE-184"],"updated_at":"2026-11-02T14:34:40.982917Z"}],"euvd":[{"id":"EUVD-2022-55223","description":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.","status":"published","published":"2025-09-08T00:00:00Z","modified":"2025-11-17T16:01:40Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:16.584357Z"}],"ghsa":[{"id":"GHSA-m379-7mfm-wqr6","title":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online...","description":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.","status":"published","published":"2025-09-08T15:37:44Z","modified":"2025-11-17T18:31:29Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-184","CWE-820"],"updated_at":"2026-11-02T15:04:50.199532Z"}],"nvd":[{"id":"CVE-2022-50238","description":"The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.","status":"disputed","published":"2025-09-08T15:15:32.37Z","modified":"2026-11-10T12:10:00.177Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-820","CWE-184"],"updated_at":"2026-11-10T14:19:24.315701Z"}]}}