Is Sysmon 14.12 still vulnerable to CVE-2022-41120

Question

Hello I was just wondering whether new release of sysmon v14.12 is still vulnerable to CVE-2022-41120 as there is no mention of it explicitly within release notes.

https://techcommunity.microsoft.com/t5/sysinternals-blog/process-explorer-v17-02-and-sysmon-v14-12/ba-p/3673982?s=09

additional info about CVE-2022-41120 is here:

[1] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41120

[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41120

[3] https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

[4] https://twitter.com/filip_dragovic/status/1590052248260055041?s=20&t=UcHUZQojzGTgC0zNykEA9g

Answer 1

Yes unfortunately. According to the researcher who found the vulnerability (Filip Dragovic), v14.12 is also vulnerable.
Please see https://twitter.com/filip_dragovic/status/1591170093823979521 and note that Filip mistyped the version as 14.2 (instead of 14.12).

Answer 2

Ouch, so are versions older than 14.x affected by this? Can we count on 13.34 being safe from this vulnerability? I am really uncomfortable with how the official MS vulnerability page does not mention anything about what Sysmon versions are or are not affected by this.