CVE-2023-21758
Memory Safety in Microsoft Windows 10 1607 … 22h2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-21758 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2023-21758 is a denial of service flaw in the Windows Internet Key Exchange (IKE) Extension, assigned a CVSS 3.1 base score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and linked to CWE-476. It affects the IKE component responsible for VPN and IPsec key negotiation on Windows systems.
An unauthenticated attacker with network access can send specially crafted traffic to trigger the flaw, resulting in a high-impact denial of service that disrupts IKE operations without affecting confidentiality or integrity.
Microsoft security advisories available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21758 describe the official patches and recommended mitigation actions for affected Windows versions.
The associated EPSS score rose from lower values after disclosure to a peak of 0.5296 on 2025-12-11 before receding to the current 0.4276, indicating a material increase in observed exploitation interest that warrants renewed attention.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25925
Vulnerability Data
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.