# CVE-2022-41033: Type confusion in Windows COM+ Event System Service

Type confusion in Windows COM+ Event System es.dll PutPropertyBag lets a local user alias a VT_BLOB as a PROPVARIANT vector, dereferencing a fake IUnknown pointer for code execution as LOCAL SERVICE.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: Anonymous
- Disclosed: 2022-10-11
- CVE: CVE-2022-41033
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-41033.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-41033
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** COM+ Event System service (es.dll) IEventSubscriptionTier2::Store
**Root cause:** InMemoryRegRow::PutPropertyBag trusts the caller-supplied PROPVARIANT vectors without checking the vt field, so a VT_BLOB aliases CAPROPVARIANT (cbSize->cElems, pBlobData->pElems), letting attacker bytes be treated as a PROPVARIANT array.
**Steps:**
1. CoCreateInstance EventSystemTier2 (CLSID 1be1f766-5536-11d1-b726-00c04fb926af) as LOCAL_SERVER
2. Call IEventSystemTier2::CreateSubscription with transient=TRUE to get IEventSubscriptionTier2
3. Build a VT_BLOB whose bytes are a fake PROPVARIANT with vt=VT_UNKNOWN and punkVal=0x12345678
4. Call sub->Store(ev, metadata[18], &name_prop, &val_prop, ...) passing the blob as the Values vector
5. PropVariantCopy dereferences the fake IUnknown pointer, crashing at OLEAUT32!VariantCopy+0x9b
**How found:** Manual analysis suspected due to the number of arguments needed to reach the code; noted the PROPVARIANT union allows aliasing CAPROPVARIANT with BLOB since the vt field is unchecked.
**Exploitation:** Local unprivileged user reaches the service via COM; the fake VT_UNKNOWN pointer inside the blob is dereferenced by PropVariantCopy calling IUnknown::AddRef, giving controlled pointer dereference in a LOCAL SERVICE process holding SeImpersonatePrivilege, enabling impersonation of an admin token for full system compromise.
**Escalation:** LOCAL SERVICE with SeImpersonatePrivilege allows token impersonation to administrator after achieving code execution in the service.
**Insight:** When a COM method takes PROPVARIANT vectors, check whether the callee validates vt before indexing pElems; alias CAPROPVARIANT with VT_BLOB to smuggle arbitrary bytes as a PROPVARIANT array past the COM marshaller's length check.