Wiz
Vulnerability DatabaseCVE-2022-40709

CVE-2022-40709: 
Trend Micro Deep Security Agent vulnerability analysis and mitigation

Overview

An Out-of-bounds read vulnerability was discovered in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows. The vulnerability, identified as CVE-2022-40709, was disclosed on September 23, 2022. The vulnerability specifically exists within the User Mode Hooking Monitor Engine (ZDI Advisory).

Technical details

The vulnerability stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L), indicating a relatively moderate severity level (ZDI Advisory).

Impact

This vulnerability could allow a local attacker to disclose sensitive information on affected installations of Trend Micro Deep Security. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of SYSTEM (ZDI Advisory).

Mitigation and workarounds

Trend Micro has issued an update to correct this vulnerability. Users are advised to update to the latest version of the software (ZDI Advisory).

Additional resources

Source: This report was generated using AI

Related Trend Micro Deep Security Agent vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2024-51503HIGH8.8
  • Trend Micro Deep Security AgentTrend Micro Deep Security Agent
  • cpe:2.3:a:trendmicro:deep_security_agent
NoYesNov 19, 2024
CVE-2025-30641HIGH7.8
  • Trend Micro Deep Security AgentTrend Micro Deep Security Agent
  • cpe:2.3:a:trendmicro:deep_security_agent
NoYesJun 17, 2025
CVE-2025-30640HIGH7.8
  • Trend Micro Deep Security AgentTrend Micro Deep Security Agent
  • cpe:2.3:a:trendmicro:deep_security_agent
NoYesJun 17, 2025
CVE-2024-55955HIGH7.3
  • Trend Micro Deep Security AgentTrend Micro Deep Security Agent
  • cpe:2.3:a:trendmicro:deep_security_agent
NoYesDec 31, 2024
CVE-2025-30642MEDIUM5.5
  • Trend Micro Deep Security AgentTrend Micro Deep Security Agent
  • cpe:2.3:a:trendmicro:deep_security_agent:*:*:*:*:long_term_support:*:*:*
NoYesJun 17, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo