CVE-2022-4991
Description
Tychon on Windows is vulnerable to privilege escalation because an unprivileged user can control the OpenSSL configuration directory, allowing arbitrary code execution as SYSTEM.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Tychon on Windows is vulnerable to privilege escalation because an unprivileged user can control the OpenSSL configuration directory, allowing arbitrary code execution as SYSTEM.
Vulnerability
Tychon utilizes an OpenSSL component that defines the OPENSSLDIR variable pointing to a subdirectory on the Windows filesystem that is writable by unprivileged users. A privileged service within Tychon relies on this component, creating a scenario where the application's configuration environment is susceptible to unauthorized modification [1].
Exploitation
An unprivileged local attacker can exploit this vulnerability by placing a specially-crafted openssl.cnf file into the directory path identified by the OPENSSLDIR variable. When the Tychon privileged service initializes or interacts with the OpenSSL component, it will load the malicious configuration file, leading to the execution of arbitrary code [1].
Impact
Successful exploitation of this vulnerability allows an unprivileged user to execute arbitrary code with SYSTEM privileges on the affected Windows system. This results in a complete compromise of the host, granting the attacker full control over the operating system [1].
Mitigation
This vulnerability is addressed in Tychon version 1.7.857.82. Users are advised to update to this version or later to remediate the issue [1].
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1News mentions
0No linked articles in our index yet.