How severe is CVE-2022-27499?

CVE-2022-27499 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-27499 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-27499?

CVE-2022-27499 primarily affects Intel Sgx Sdk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-27499?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-27499 published?

CVE-2022-27499 was published on 2022-11-11 and last updated on 2026-06-17.

CVE-2022-27499

CVE-2022-27499 is a low-severity vulnerability in Intel Sgx Sdk with a CVSS 3.x base score of 2.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-672.

Key facts

Severity: Low (CVSS 3.x base score 2.5)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-672
Affected product: Intel Sgx Sdk
Published: 2022-11-11
Last modified: 2026-06-17

Description

Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.

Frequently asked questions

What is CVE-2022-27499?: Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.
How severe is CVE-2022-27499?: CVE-2022-27499 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-27499 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-27499?: CVE-2022-27499 primarily affects Intel Sgx Sdk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-27499?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-27499 published?: CVE-2022-27499 was published on 2022-11-11 and last updated on 2026-06-17.

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00691.html

Affected products (2)

cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:windows:*:*
cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:linux:*:*

More vulnerabilities in Intel Sgx Sdk

CVE-2018-18098 — High (CVSS 7.3): Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may…
CVE-2021-0186 — Medium (CVSS 6.7): Improper input validation in the Intel(R) SGX SDK applications compiled for SGX2 enabled processors may allow a…
CVE-2022-21166 — Medium (CVSS 5.5): Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an…
CVE-2022-21127 — Medium (CVSS 5.5): Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated…
CVE-2022-21125 — Medium (CVSS 5.5): Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to…
CVE-2022-21123 — Medium (CVSS 5.5): Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to…

All CVEs affecting Intel Sgx Sdk →

Other CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities

CVE-2023-41094 — Critical (CVSS 10.0): TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing…
CVE-2020-24030 — Critical (CVSS 9.8): ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and…
CVE-2020-12043 — Critical (CVSS 9.8): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP…
CVE-2019-17638 — Critical (CVSS 9.4): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an…
CVE-2013-10075 — Critical (CVSS 9.1): Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores…
CVE-2022-22755 — High (CVSS 8.8): By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute…

Browse all CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities →