# CVE-2022-30225 — Windows Media Player Network Sharing Service `wmpnetwk.exe` Registry-Symlink EoP

## Summary
| | |
|---|---|
| **Product** | Windows — `wmpnetwk.exe` (Windows Media Player Network Sharing Service) |
| **CVE ID** | CVE-2022-30225 |
| **Impact** | Elevation of Privilege / DoS |
| **CWE** | CWE-59: Improper Link Resolution Before File Operation |
| **Patch Date** | July 12, 2022 |
| **Pre-patch** | `wmpnetwk.exe` 12.0.19041.746 |
| **Post-patch** | `wmpnetwk.exe` 12.0.19041.1826 |
| **Fix gating** | None — symlink check added |

## Vulnerability
`wmpnetwk.exe` runs as **NT AUTHORITY\NETWORK SERVICE** and is driven by the Windows Media Player **`UpdateLibrary`** scheduled task (via `wmpnscfg.exe`). During the library update it creates a random-UUID registry subkey and, during cleanup, **recursively deletes registry subkeys without validating registry symbolic links**. A standard user creates a subkey they own, sets its DACL to full control, and plants a registry symlink inside it; the NETWORK SERVICE process follows the link during the recursive delete and removes/modifies a **protected registry key** — EoP / DoS (CWE-59).

## The patch (confirmed — diff)
The recursive delete (`ATL::CRegKey::RecurseDeleteKey` / new `DeleteKeyRecursive_64KEY_Recurse`) now queries each key with `NtQueryKey` and checks for a **symbolic link** (new `SymbolicLinkVal` handling) before `NtDeleteKey` — refusing to follow attacker-planted symlinks. The pre-patch path used raw `RegDeleteKeyExW`/`RegDeleteKeyW`; the post-patch adds the `NtQueryKey`/`NtDeleteKey` symlink-aware logic. Unconditional (2022).

## Detection
Standard users creating subkeys / `REG_OPTION_CREATE_LINK` symlinks in the WMP library-path cleanup area; `wmpnetwk.exe` (NETWORK SERVICE) deleting unexpected protected registry keys.

## References
- CVE-2022-30225 · MSRC advisory · Full diff: `/data/patch_diffs/wmpnetwk_exe-cve-2022-30225-ghidriff.md`
- Related registry-symlink EoPs: CVE-2025-59512, CVE-2025-59514, CVE-2025-59511, CVE-2022-35820