Cyber Resilience

CVE-2023-29336

HighCISA KEVActive ExploitationEUVD ExploitedPublic PoC

Published: 09 May 2023

Published
09 May 2023
Modified
28 October 2025
KEV Added
09 May 2023
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7666 99.0th percentile
Risk Priority 82 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-29336 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-29336 is a use-after-free vulnerability (CWE-416) in the Win32k component of the Windows kernel that carries a CVSS 3.1 score of 7.8. The flaw permits an authenticated local user to elevate privileges on affected Windows systems.

An attacker who already possesses a low-privileged local account can trigger the vulnerability without user interaction to obtain full administrative control over the host, resulting in complete compromise of confidentiality, integrity, and availability.

Microsoft’s security update guide provides patches that address the issue, and the vulnerability appears in CISA’s catalog of known exploited vulnerabilities. The associated EPSS score has remained elevated, with a current value of 0.7666 and a recorded peak of 0.7946. Public exploit code is also available.

EU & UK References

Vulnerability details

Win32k Elevation of Privilege Vulnerability

CWE(s)
KEV Date Added
09 May 2023

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.19926
microsoft
windows 10 1607
≤ 10.0.14393.5921
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely application of the vendor patch that eliminates the use-after-free flaw in Win32k.

prevent

Implements memory-protection safeguards that block exploitation of the kernel-mode use-after-free condition before privilege escalation occurs.

prevent

Enforces separate execution domains that limit the blast radius of a Win32k flaw escaping from user-mode graphics operations into SYSTEM-level kernel code.

References