CVE-2023-38146
Race Condition in Microsoft Windows 11 21H2 ≤ 10.0.22000.2416
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-38146 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Windows 11 21H2. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-38146 is a remote code execution vulnerability in the Windows Themes component. It carries a CVSS 3.1 score of 8.8 with an attack vector of network, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is associated with CWE-367.
An unauthenticated attacker can exploit the flaw by supplying a malicious theme to a target user, achieving arbitrary code execution on the affected Windows system. The attack requires the victim to interact with the theme file or resource, after which the attacker gains full control equivalent to the user’s privileges.
Microsoft’s security advisory at msrc.microsoft.com details available patches and mitigation guidance for the issue. Public references also include proof-of-concept material demonstrating arbitrary code execution via Windows 11 themes.
The EPSS score for this CVE stands at 0.8646, indicating substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41971
Vulnerability Data
Windows Themes Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.