CVE-2022-27534: 
Kaspersky Endpoint Security for Windows vulnerability analysis and mitigation

Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The vulnerability was discovered by Georgy Zaytsev from Positive Technologies and was assigned CVE-2022-27534. The vulnerability has a CVSS v3.1 base score of 9.8 (CRITICAL) (NVD).

The vulnerability was identified as an arbitrary code execution issue in a data parsing module. The vulnerability allowed attackers with ordinary user privileges to execute arbitrary code. The severity assessment indicates a critical level of risk with a CVSS v3.1 base score of 9.8, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially allow attackers to execute arbitrary code with user privileges, which could lead to complete system compromise. The high CVSS score indicates potential impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability required ordinary user privileges to exploit. No information about exploitation in the wild was reported in the available sources (Kaspersky Advisory).

The fix was delivered automatically through antivirus database updates. Users with antivirus databases released after March 12, 2022, received the fix. To verify the fix installation, users can check their antivirus database update date, which should be after March 12, 2022 (Kaspersky Advisory).