CVE-2023-21674
Published: 10 January 2023
Summary
CVE-2023-21674 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
Windows Advanced Local Procedure Call (ALPC) contains an elevation-of-privilege vulnerability tracked as CVE-2023-21674 and assigned CWE-416. The flaw resides in a core Windows kernel component and carries a CVSS 3.1 score of 8.8, reflecting local attack vector, low complexity, and low privileges required.
An authenticated local attacker can trigger the use-after-free condition to obtain SYSTEM-level privileges on an affected Windows system, resulting in full compromise of confidentiality, integrity, and availability with scope change across security boundaries.
Microsoft has published patches through its Security Response Center update guide, and the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation. The associated EPSS score has remained essentially flat near 0.20 since disclosure, indicating no material post-publication surge in observed exploitation attempts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25841
Vulnerability details
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 10 January 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches that eliminate the use-after-free flaw in ALPC before local attackers can exploit it.
Enforces least-privilege restrictions so a low-privileged account cannot reach the code paths needed to trigger the ALPC EoP.
Applies memory-protection mechanisms that can block or contain use-after-free exploitation attempts within Windows kernel components.