CVE-2023-21766
Published: 10 January 2023
Summary
CVE-2023-21766 is a medium-severity Sensitive Data Storage in Improperly Locked Memory (CWE-591) vulnerability in Microsoft Windows 10. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-21766 is an information disclosure vulnerability in the Windows Overlay Filter component. It carries a CVSS 4.7 rating reflecting local access, high attack complexity, and low privileges, with the underlying weaknesses classified as CWE-591 (sensitive data in improperly locked memory) and CWE-362 (race condition). The flaw allows an attacker to read sensitive kernel memory contents that should remain inaccessible.
A local attacker who already possesses a low-privileged account on an affected Windows system can trigger the race condition to obtain confidential data. Successful exploitation yields no integrity or availability impact and does not permit code execution or privilege escalation.
Microsoft’s security advisory at msrc.microsoft.com details the affected builds and supplies patches through the standard Windows Update channels; administrators are advised to apply the updates promptly to eliminate the information-leakage vector.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.1375 before receding to the current value of 0.0644, indicating a temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25933
Vulnerability details
Windows Overlay Filter Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.