CVE-2023-29360
Microsoft Windows 10 1607 ≤ 10.0.14393.5989
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-29360 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Microsoft Streaming Service contains an elevation of privilege vulnerability tracked as CVE-2023-29360. The flaw carries a CVSS 3.1 score of 8.4 and is associated with CWE-822. It affects the streaming service component in supported Microsoft products and allows an attacker to obtain elevated privileges on an affected system.
An unauthenticated local attacker can exploit the issue without user interaction. Successful exploitation grants full control over confidentiality, integrity, and availability on the target host, enabling the attacker to execute arbitrary code with elevated rights.
Microsoft has published remediation guidance through its Security Response Center, and the vulnerability appears in CISA’s catalog of known exploited vulnerabilities. The associated EPSS score has remained near 0.30 with only minor fluctuation between its recorded peak and current values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32933
Vulnerability Data
Microsoft Streaming Service Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 29 February 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of untrusted pointer handling during development.
Runtime monitoring of software and data can detect adverse events resulting from exploitation of the weakness.
Vulnerability identification processes can discover instances of this weakness via code review or scanning.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect pointer-dereference flaws before release.
Secure development lifecycle includes pointer-safety practices that reduce untrusted pointer dereference risk.
Application security requirements can mandate validation of pointers obtained from untrusted sources.
Secure architecture principles discourage direct use of untrusted values as pointers.
Secure coding standards explicitly forbid dereferencing pointers derived from untrusted input.