CVE-2022-24451: Microsoft VP9 Video Extensions RCE Flaw

CVE-2022-24451 Overview

CVE-2022-24451 is a remote code execution vulnerability in the Microsoft VP9 Video Extensions component. The flaw allows an attacker to execute arbitrary code on a target system when a user opens a specially crafted VP9-encoded media file. Microsoft VP9 Video Extensions is a codec package installed from the Microsoft Store that enables Windows applications to play VP9 video content. The vulnerability requires user interaction and operates with local scope, meaning an attacker must deliver a malicious file and convince the user to open it in an application that invokes the codec.

Critical Impact

Successful exploitation allows arbitrary code execution in the context of the user processing the malicious VP9 media file, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• Microsoft VP9 Video Extensions (all versions prior to the March 2022 update)
• Windows applications that use the VP9 codec for media playback
• Microsoft Store-distributed VP9 Video Extensions package

Discovery Timeline

• 2022-03-09 - CVE-2022-24451 published to the National Vulnerability Database (NVD)
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24451

Vulnerability Analysis

The vulnerability resides in Microsoft VP9 Video Extensions, the codec component responsible for decoding VP9 video streams on Windows. The flaw enables an attacker to execute arbitrary code with the privileges of the user who opens a crafted media file. The CWE classification is recorded as NVD-CWE-noinfo, reflecting limited public technical detail from the vendor. Microsoft's advisory categorizes the issue as a remote code execution flaw rather than a memory disclosure or denial-of-service condition.

Exploitation requires the target to open or preview a malicious VP9-encoded file in an application that invokes the codec, such as Movies & TV or other media-handling applications. Because codec parsing typically occurs in user-mode media pipelines, successful exploitation yields code execution at the current user's privilege level. An EPSS score of 1.894% places this CVE in the 83rd percentile, indicating elevated exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is improper handling of malformed VP9 bitstream data inside the codec's parsing logic. Crafted frame headers or compressed payloads trigger an unsafe operation during decode, allowing attacker-controlled data to influence execution flow. Microsoft did not publish granular root-cause details in the advisory.

Attack Vector

The attack vector is local with required user interaction. An attacker hosts or distributes a crafted VP9 file through web downloads, email attachments, removable media, or shared storage. When the user opens the file in an application that invokes the VP9 codec, parsing of the malicious stream triggers code execution. No elevated privileges are required to initiate the attack.

Microsoft has not released public exploitation code for this issue. Refer to the Microsoft Vulnerability Advisory CVE-2022-24451 for vendor technical details.

Detection Methods for CVE-2022-24451

Indicators of Compromise

• Unexpected child processes spawned by media player applications such as Microsoft.ZuneVideo or other VP9-consuming hosts
• VP9 media files (.webm, .mkv, .mp4 containing VP9 streams) arriving from untrusted sources and accessed shortly before suspicious process activity
• Anomalous network connections or file writes originating from media playback processes

Detection Strategies

• Inventory installed versions of the VP9 Video Extensions package on managed endpoints and compare against the patched build available through the Microsoft Store
• Monitor for crashes or exception events in media host processes that may indicate exploitation attempts against codec parsers
• Hunt for media files delivered via phishing campaigns or external file shares that are opened by users on workstations with outdated codec packages

Monitoring Recommendations

• Enable PowerShell and process creation logging to capture child processes of media applications
• Forward Microsoft Store application update events to your SIEM to verify codec patch deployment status
• Track endpoints where VP9 Video Extensions remains unpatched and alert on media file execution from email or browser download directories

How to Mitigate CVE-2022-24451

Immediate Actions Required

• Update Microsoft VP9 Video Extensions to the latest version through the Microsoft Store on all affected endpoints
• Verify that automatic Microsoft Store app updates are enabled across the environment to receive the codec patch
• Restrict opening of untrusted VP9 media files until the codec package is confirmed patched

Patch Information

Microsoft released a security update for VP9 Video Extensions delivered via the Microsoft Store. Refer to the Microsoft Vulnerability Advisory CVE-2022-24451 for the fixed package version and deployment guidance. Updates are pushed automatically when Microsoft Store auto-update is enabled.

Workarounds

• Uninstall the VP9 Video Extensions package on systems that do not require VP9 playback until patching is complete
• Block delivery of VP9-containing media files at email gateways and web proxies for high-risk user populations
• Educate users to avoid opening unsolicited video attachments and downloads from untrusted sources

# Verify and update VP9 Video Extensions via PowerShell
Get-AppxPackage -Name "Microsoft.VP9VideoExtensions" | Select-Object Name, Version

# Force a Microsoft Store update check
Start-Process "ms-windows-store://downloadsandupdates"

# Optionally remove the package on systems that do not require VP9 playback
Get-AppxPackage -Name "Microsoft.VP9VideoExtensions" | Remove-AppxPackage