CVE-2022-40708: 
Trend Micro Deep Security Agent vulnerability analysis and mitigation

An Out-of-bounds read vulnerability (CVE-2022-40708) was discovered in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows. The vulnerability was reported on February 16, 2022, and publicly disclosed on September 23, 2022 (ZDI Advisory).

The vulnerability exists within the User Mode Hooking Monitor Engine of Trend Micro Deep Security. The specific flaw results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) (ZDI Advisory).

This vulnerability could allow a local attacker to disclose sensitive information on affected installations. An attacker could potentially leverage this vulnerability in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of SYSTEM (ZDI Advisory).

Trend Micro has issued an update to correct this vulnerability. Users are advised to apply the security update available through the vendor's solution page (ZDI Advisory).