Cyber Resilience

CVE-2023-38146

Race Condition in Microsoft Windows 11 21H2 ≤ 10.0.22000.2416

Public PoCRace Condition
Published
12 September 2023
Modified
01 January 2025
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.39 99th percentile
Risk Priority 90 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-38146 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Windows 11 21H2. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-38146 is a remote code execution vulnerability in the Windows Themes component. It carries a CVSS 3.1 score of 8.8 with an attack vector of network, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is associated with CWE-367.

An unauthenticated attacker can exploit the flaw by supplying a malicious theme to a target user, achieving arbitrary code execution on the affected Windows system. The attack requires the victim to interact with the theme file or resource, after which the attacker gains full control equivalent to the user’s privileges.

Microsoft’s security advisory at msrc.microsoft.com details available patches and mitigation guidance for the issue. Public references also include proof-of-concept material demonstrating arbitrary code execution via Windows 11 themes.

The EPSS score for this CVE stands at 0.8646, indicating substantial exploitation interest following disclosure.

EU & UK References

Vulnerability Data

Windows Themes Remote Code Execution Vulnerability

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
T1574 Hijack Execution Flow Stealth
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-35265Same product: Microsoft Windows 11 21H2
CVE-2024-26218Same product: Microsoft Windows 11 21H2
CVE-2024-38186Same product: Microsoft Windows 11 21H2
CVE-2024-30099Same product: Microsoft Windows 11 21H2
CVE-2024-30088Same product: Microsoft Windows 11 21H2
CVE-2023-33154Same product: Microsoft Windows 11 21H2
CVE-2024-21362Same product: Microsoft Windows 11 21H2
CVE-2023-38141Same product: Microsoft Windows 11 21H2
CVE-2024-21371Same product: Microsoft Windows 11 21H2
CVE-2024-29062Same product: Microsoft Windows 11 21H2

Affected Assets

microsoft
windows 11 21h2
≤ 10.0.22000.2416
microsoft
windows 11 22h2
≤ 10.0.22621.2275

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-367

Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

References