CVE-2023-21766
Race Condition in Microsoft Windows 10 1607 … 22h2
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-21766 is a medium-severity Sensitive Data Storage in Improperly Locked Memory (CWE-591) vulnerability in Microsoft Windows 10. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-21766 is an information disclosure vulnerability in the Windows Overlay Filter component. It carries a CVSS 4.7 rating reflecting local access, high attack complexity, and low privileges, with the underlying weaknesses classified as CWE-591 (sensitive data in improperly locked memory) and CWE-362 (race condition). The flaw allows an attacker to read sensitive kernel memory contents that should remain inaccessible.
A local attacker who already possesses a low-privileged account on an affected Windows system can trigger the race condition to obtain confidential data. Successful exploitation yields no integrity or availability impact and does not permit code execution or privilege escalation.
Microsoft’s security advisory at msrc.microsoft.com details the affected builds and supplies patches through the standard Windows Update channels; administrators are advised to apply the updates promptly to eliminate the information-leakage vector.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.1375 before receding to the current value of 0.0644, indicating a temporary increase in observed exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25933
Vulnerability Data
Windows Overlay Filter Information Disclosure Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.DS-01 encryption of data-at-rest can protect swapped pages but does not stop improper memory locking, addressing only one exposure facet of the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls can reduce exposure of sensitive data even if it is paged, but do not directly enforce memory locking.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing including code scans/penetration tests, developer training) that reach race conditions in concurrent code, but only as one slice of a broad requirement whose implementation scope and rigour are left to the organisation.
Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
Secure-coding standards can mandate use of locked-memory APIs, directly preventing the weakness.
Security testing can discover unlocked sensitive buffers, but does not itself implement the locking mechanism.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. blocks CWE-591