CVE-2023-21758
Published: 10 January 2023
Summary
CVE-2023-21758 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-21758 is a denial of service flaw in the Windows Internet Key Exchange (IKE) Extension, assigned a CVSS 3.1 base score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and linked to CWE-476. It affects the IKE component responsible for VPN and IPsec key negotiation on Windows systems.
An unauthenticated attacker with network access can send specially crafted traffic to trigger the flaw, resulting in a high-impact denial of service that disrupts IKE operations without affecting confidentiality or integrity.
Microsoft security advisories available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21758 describe the official patches and recommended mitigation actions for affected Windows versions.
The associated EPSS score rose from lower values after disclosure to a peak of 0.5296 on 2025-12-11 before receding to the current 0.4276, indicating a material increase in observed exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25925
Vulnerability details
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.