CVE-2023-23406
Published: 14 March 2023
Summary
CVE-2023-23406 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-23406 is a remote code execution flaw affecting the Microsoft PostScript and PCL6 Class Printer Driver. It carries a CVSS 3.1 base score of 8.8 and is associated with CWE-122. The issue was published on 14 March 2023.
An attacker with low privileges can exploit the flaw over a network connection without user interaction, resulting in full impact to confidentiality, integrity, and availability on the affected system.
Microsoft's security update guide at msrc.microsoft.com provides remediation details and patches for the vulnerability. The EPSS score has remained flat at 0.1322 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27506
Vulnerability details
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.