CVE-2023-38171
Published: 10 October 2023
Summary
CVE-2023-38171 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Visual Studio 2022. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-38171 is a denial-of-service flaw in Microsoft QUIC, carrying a CVSS 3.1 score of 7.5 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and linked to CWE-476. It affects the QUIC protocol implementation in Microsoft products and can produce a high-impact availability loss when triggered.
An unauthenticated remote attacker can send specially crafted network traffic to exploit the issue and cause the affected QUIC endpoint to stop responding, resulting in denial of service without any user interaction or credentials.
Microsoft has published guidance for the vulnerability in its security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171. The associated EPSS probability reached a peak of 0.0987 and currently stands at 0.0830.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2837
Vulnerability details
Microsoft QUIC Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.