Type Vulnerability
CVE-2023-36424 is confirmed as exploited in the wild (US known-exploited catalogue) Authoritative catalogues report active exploitation of this vulnerability.
Microsoft · Memory corruption
Microsoft Windows Out-of-Bounds Read Vulnerability
CVE-2023-36424
What this means
This is rated high severity (7.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft Windows 10 1507, Microsoft Windows 10 1607 and Microsoft Windows 10 1809, and 11 more are in your estate, and treat that as the priority.
Full vendor description
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Scoring and exploitation
7.8/ 10
CVSS 3.1 base scoreHigh
Exploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorLocalAV:L
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~12.1% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Microsoft Windows
Weaknesses
CWE-125
Affected products ()
- Microsoft Windows 10 1507
- Microsoft Windows 10 1607
- Microsoft Windows 10 1809
- Microsoft Windows 10 21h2
- Microsoft Windows 10 22h2
- Microsoft Windows 11 21h2
- Microsoft Windows 11 22h2
- Microsoft Windows 11 23h2
- Microsoft Windows Server 2008
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Server 2022
- Microsoft Windows Server 2022 23h2
Show the raw CPE strings (21)
- cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
References
3 links from the CVE record, grouped by site; the vendor's advisory comes first.
msrc.microsoft.com1 linkVendor advisory
- CVE-2023-36424 (opens in a new tab)Patch · Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource