Out-of-bounds read in Trend Micro Security (Consumer) and Maximum Security - CVE-2022-37347
Published: September 1, 2022
Vulnerability identifier: #VU66907
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-37347
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the User Mode Hooking Monitor Engine. A local user can pass specially crafted input to the application and read contents of memory on the system.
Affected software
Trend Micro Security (Consumer)
Maximum Security
Maximum Security
How to mitigate CVE-2022-37347
Install updates from vendor's website.
Trend Micro Security (Consumer) - addressed in versions 17.0 hotfix, 17.7 hotfix
Maximum Security - addressed in versions 2021 v17.0 Hotfix, 2022 v17.7 Hotfix
Maximum Security - addressed in versions 2021 v17.0 Hotfix, 2022 v17.7 Hotfix