CVE-2023-36033
Published: 14 November 2023
Summary
CVE-2023-36033 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 23.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2023-36033 is an elevation-of-privilege vulnerability in the Windows DWM Core Library that carries a CVSS 3.1 score of 7.8. The flaw stems from improper handling of objects in memory (CWE-119) and incorrect pointer dereferences (CWE-822), allowing an authenticated local user to execute arbitrary code with elevated privileges on affected Windows systems.
An attacker with low-privileged local access can exploit the issue without user interaction to obtain full control over the affected host, resulting in complete compromise of confidentiality, integrity, and availability. The attack vector is strictly local and does not require network access or elevated rights to begin.
Microsoft has published security updates addressing the vulnerability through its update guide, and the flaw appears in CISA’s catalog of known exploited vulnerabilities, confirming that in-the-wild exploitation has been observed. The associated EPSS score remains low, with a current value of 0.0091 and a peak of 0.0118.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40017
Vulnerability details
Windows DWM Core Library Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 14 November 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of vendor patches that remediate the DWM memory-corruption flaw before local exploitation can succeed.
Enforces least privilege so a local account cannot obtain SYSTEM-level rights even if the DWM EoP succeeds.
Implements memory-protection mechanisms that can block the invalid-pointer and memory-corruption primitives used by CVE-2023-36033.