CVE-2023-23388
Microsoft Windows 10 1507 ≤ 10.0.10240.19805
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2023-23388 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-23388 is an elevation-of-privilege vulnerability in the Windows Bluetooth Driver. It carries a CVSS 3.1 base score of 8.8 with the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and is also associated with CWE-681. The flaw resides in the Bluetooth driver component of supported Windows releases and permits an attacker to gain elevated privileges on an affected system.
A local attacker with low privileges and no user interaction can exploit the issue to execute arbitrary code with elevated rights, resulting in full compromise of confidentiality, integrity, and availability on the host and potentially affecting other security contexts due to the changed scope.
Microsoft has published remediation guidance and security updates for the vulnerability through its Security Response Center at the listed advisory URL. Administrators should apply the patches corresponding to their Windows versions to eliminate the exposure.
The associated EPSS score has reached a peak of 0.1765 with a current value of 0.1366; no public information on in-the-wild exploitation is provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27488
Vulnerability Data
Windows Bluetooth Driver Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code reviews, static analysis, and developer training that catch and prevent numeric type-conversion errors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect numeric conversion defects before release.
Secure development lifecycle includes type-safety and conversion checks that reduce numeric truncation risks.
Application security requirements can mandate safe numeric handling and range validation.
Secure architecture principles promote strong typing and safe conversion practices.
Secure coding standards directly address correct numeric type conversions and overflow checks.