CVE-2023-36802
Published: 12 September 2023
Summary
CVE-2023-36802 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
Microsoft Streaming Service Proxy contains an elevation of privilege vulnerability tracked as CVE-2023-36802 and assigned CWE-416. The flaw affects a Windows kernel-mode component that handles streaming proxy operations and carries a CVSS 3.1 score of 7.8 reflecting local attack vector, low complexity, and low privileges required.
A local attacker who already possesses a low-privileged account on an affected system can trigger the vulnerability to obtain SYSTEM-level privileges, resulting in full control over confidentiality, integrity, and availability of the host. No user interaction is needed beyond the ability to run code locally.
Microsoft has published an advisory and corresponding security update that resolves the issue. The vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The associated EPSS score currently stands at 0.7543 with a recorded peak of 0.7891.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40740
Vulnerability details
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 12 September 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch Microsoft published for CVE-2023-36802, eliminating the use-after-free flaw before exploitation.
Enforces memory-protection mechanisms that block exploitation of the use-after-free condition (CWE-416) in the Streaming Service Proxy.
Restricts the low-privileged local account's baseline rights, limiting the impact even if the proxy vulnerability is triggered to obtain higher privileges.