Cyber Resilience

CVE-2023-36396

Microsoft Windows 11 22H2 ≤ 10.0.22621.2715

Published
14 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.017 75th percentile
Risk Priority 60 floored blend · peak EPSS

Summary

CVE-2023-36396 is a high-severity Improper Resolution of Path Equivalence (CWE-41) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 25% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Windows Compressed Folder Remote Code Execution Vulnerability

CWE(s)
CWE-41NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-38165Same product: Microsoft Windows 11 22H2
CVE-2024-26185Same product: Microsoft Windows 11 22H2
CVE-2025-21219Same product: Microsoft Windows 11 22H2
CVE-2024-30073Same product: Microsoft Windows 11 22H2
CVE-2025-21189Same product: Microsoft Windows 11 22H2
CVE-2025-21332Same product: Microsoft Windows 11 22H2
CVE-2025-21328Same product: Microsoft Windows 11 22H2
CVE-2025-21247Same product: Microsoft Windows 11 22H2
CVE-2025-21329Same product: Microsoft Windows 11 22H2
CVE-2025-54107Same product: Microsoft Windows 11 22H2

Affected Assets

microsoft
windows 11 22h2
≤ 10.0.22621.2715 · ≤ 10.0.22621.2715
microsoft
windows 11 23h2
≤ 10.0.22621.2715 · ≤ 10.0.22621.2715

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent introduction of improper path-resolution logic in software.

PR.IR-01 partial match
prevents

Path-equivalence flaws enable unauthorized file access that network segmentation and logical access controls can partially block.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match
prevents

Secure coding standards directly require canonical path resolution and input sanitization to prevent equivalence attacks.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect path-equivalence flaws before release, partially fulfilling the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes path-handling requirements that reduce equivalence-based disclosure.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate canonicalization and input validation to block path equivalence.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles call for safe file-system abstractions that mitigate path traversal risks.

A.8.3 Information access restriction none match
none

Information access restriction limits what files can be reached, indirectly reducing impact of path-equivalence exploits.

References