Microsoft · Security update · October 11, 2022

KB5018419: October 2022 cumulative update for Windows 10 1809

KB5018419, released October 11, 2022, fixes 60 CVEs across 5 products. 2 of them are being exploited (CVE-2022-38028); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
60
9 rated Critical
Exploited
2
CVE-2022-38028
Exploitation more likely
6
Microsoft's assessment
Highest EPSS
0.5627
99th percentile

Priority of the 60 CVEs

Patch now 2 Urgent 15 High 31 Routine 12

Applies to

ProductBuild after install
Windows 10 Version 1809 for 32-bit Systems17763.3532
Windows 10 Version 1809 for ARM64-based Systems17763.3532
Windows 10 Version 1809 for x64-based Systems17763.3532
Windows Server 201917763.3532
Windows Server 2019 (Server Core installation)17763.3532

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2022-38028 Windows Print Spooler ComponentsElevation of Privilege7.8 0.1495 KEVExploited
Patch now CVE-2022-41033 Windows COM+ Event System ServiceElevation of Privilege7.8 0.0189 KEVExploited
Urgent CVE-2022-37970 Windows DWM Core LibraryElevation of Privilege7.8 0.0977 More likely
Urgent CVE-2022-37989 Client Server Run-time Subsystem (CSRSS)Elevation of Privilege7.8 0.0933 More likely
Urgent CVE-2022-37987 Client Server Run-time Subsystem (CSRSS)Elevation of Privilege7.8 0.0910 More likely
Urgent CVE-2022-38050 Windows Win32KElevation of Privilege7.8 0.0732 More likely
Urgent CVE-2022-38051 Microsoft Graphics ComponentElevation of Privilege7.8 0.0732 More likely
Urgent CVE-2022-37976 Role: Active Directory Certificate Services; Active Directory Domain ServicesElevation of Privilege8.8 0.0239 Exploitation Less Likely
Urgent CVE-2022-41081 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0195 Exploitation Less Likely
Urgent CVE-2022-38000 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0163 Exploitation Less Likely
Urgent CVE-2022-22035 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0157 Exploitation Less Likely
Urgent CVE-2022-38047 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0147 Exploitation Less Likely
Urgent CVE-2022-24504 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0146 Exploitation Less Likely
Urgent CVE-2022-30198 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0146 Exploitation Less Likely
Urgent CVE-2022-33634 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0146 Exploitation Less Likely
Urgent CVE-2022-37997 Microsoft Graphics ComponentElevation of Privilege7.8 0.0068 More likely
Urgent CVE-2022-37979 Role: Windows Hyper-VElevation of Privilege7.8 0.0063 Exploitation Less Likely
High CVE-2022-38044 Windows CD-ROM DriverRemote Code Execution7.8 0.5627 Exploitation Less Likely
High CVE-2022-38034 Windows Workstation ServiceElevation of Privilege8.8 0.0400 Exploitation Less Likely
High CVE-2022-38045 Windows Server ServiceElevation of Privilege8.8 0.0281 Exploitation Less Likely
High CVE-2022-33645 Windows TCP/IPDenial of Service7.5 0.0264 Exploitation Less Likely
High CVE-2022-38041 Windows Secure ChannelDenial of Service7.5 0.0261 Exploitation Less Likely
High CVE-2022-38046 Windows Web Account ManagerInformation Disclosure7.5 0.0233 Exploitation Less Likely
High CVE-2022-37982 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0202 Exploitation Less Likely
High CVE-2022-38031 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0202 Exploitation Less Likely
Showing 1 to 25 of 60 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.