CVE-2023-38146
Race Condition in Microsoft Windows 11 21H2 ≤ 10.0.22000.2416
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2023-38146 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Windows 11 21H2. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-38146 is a remote code execution vulnerability in the Windows Themes component. It carries a CVSS 3.1 score of 8.8 with an attack vector of network, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is associated with CWE-367.
An unauthenticated attacker can exploit the flaw by supplying a malicious theme to a target user, achieving arbitrary code execution on the affected Windows system. The attack requires the victim to interact with the theme file or resource, after which the attacker gains full control equivalent to the user’s privileges.
Microsoft’s security advisory at msrc.microsoft.com details available patches and mitigation guidance for the issue. Public references also include proof-of-concept material demonstrating arbitrary code execution via Windows 11 themes.
The EPSS score for this CVE stands at 0.8646, indicating substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41971
Vulnerability Data
Windows Themes Remote Code Execution Vulnerability
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks execution of the malicious theme file that delivers the RCE payload.
Requires prompt application of the vendor patch that eliminates the Themes component flaw.
Verifies integrity of theme resources and system files to stop or detect tampering used in the attack.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.