CVE-2023-36596
Published: 10 October 2023
Summary
CVE-2023-36596 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 46.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-36596 is a Remote Procedure Call Information Disclosure Vulnerability affecting Microsoft components responsible for handling RPC communications. It received a CVSS 3.1 score of 7.5 reflecting network-accessible exposure with no required authentication or user interaction that can result in high-impact confidentiality loss while leaving integrity and availability unaffected. The issue is also associated with CWE-822 and CWE-668.
An unauthenticated remote attacker can exploit the flaw to disclose sensitive information from the targeted system. No special privileges or user interaction are needed for successful exploitation.
Microsoft publishes mitigation details for this vulnerability in its Security Response Center update guide at the referenced URL. The EPSS probability rose from a low baseline after disclosure to a peak of 0.0532 on 2025-01-22 before receding to the current value of 0.0030, indicating a period of increased exploitation interest that later subsided.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40541
Vulnerability details
Remote Procedure Call Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.
The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.
The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.
Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.
Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.
Controlling internal connections prevents exposure of resources to unintended internal spheres.
Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.
The control prevents exposure of the media resource to the wrong security sphere.