CVE-2023-21674
Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability
Description
CVE-2023-21674 is a high-severity elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) subsystem. The flaw is a use-after-free condition (CWE-416) that allows a locally authenticated attacker with low privileges to escalate their access and potentially escape browser-level sandboxes to gain SYSTEM-level control over the affected Windows system. This vulnerability affects a wide range of Windows versions including Windows 10, Windows 11, Windows Server 2012 through 2022, and Windows RT 8.1. CISA has confirmed active exploitation of CVE-2023-21674 in the wild, and with an EPSS score of 12.4% (93.75th percentile), exploitation activity is considered likely and ongoing.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19685 |
| microsoft | windows 10 1607 | < 10.0.14393.5648 |
| microsoft | windows 10 1809 | < 10.0.17763.3887 |
| microsoft | windows 10 20h2 | < 10.0.19042.2486 |
| microsoft | windows 10 21h2 | < 10.0.19044.2486 |
| microsoft | windows 10 22h2 | < 10.0.19045.2486 |
| microsoft | windows 11 21h2 | < 10.0.22000.1455 |
| microsoft | windows 11 22h2 | < 10.0.22621.1105 |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | < 10.0.14393.5648 |
| microsoft | windows server 2019 | < 10.0.17763.3887 |
| microsoft | windows server 2022 | < 10.0.20348.1487 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21674(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21674(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a vulnerability where a program continues to use a pointer after the memory it references has been freed. In the context of the Windows ALPC subsystem, this use-after-free condition allows an attacker to manipulate freed memory to redirect execution flow, ultimately achieving privilege escalation from a low-privileged user to SYSTEM-level access.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-21674 carries a CVSS v3.1 score of 8.8 (High), reflecting its significant potential for damage. The vulnerability requires local access (AV:L), meaning the attacker must already have some form of access to the target system, such as through a compromised application or browser sandbox. Attack complexity is low (AC:L), indicating that exploitation is reliable and does not require special timing or conditions. While low-level privileges are required (PR:L), no user interaction is needed (UI:N), enabling silent exploitation once initial access is obtained. Critically, the scope is changed (S:C), meaning a successful exploit can affect resources beyond the vulnerable ALPC component — specifically enabling sandbox escapes and cross-boundary privilege escalation. Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), as SYSTEM-level access grants complete control over the operating system, including the ability to read all data, modify system configurations, and disrupt services. With an EPSS score of 12.4%, exploitation is actively occurring and organizations should treat this as an urgent patching priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-21674 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 31, 2023. The vulnerability was reported as being exploited in targeted attacks, potentially as a browser sandbox escape chain where an initial browser vulnerability is combined with CVE-2023-21674 to achieve full system compromise. The EPSS score of 12.4% (93.75th percentile) indicates that exploitation activity, while not as widespread as some critical remote vulnerabilities, is significantly above average and consistent with targeted attack campaigns. No publicly tagged exploit code appears in the NVD references, but Microsoft has acknowledged exploitation prior to patch release through the Security Update Guide.
Remediation
- Install Microsoft security updates immediately. Apply the January 2023 security updates from Microsoft that address CVE-2023-21674 across all affected Windows versions. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Patch all affected Windows versions. This vulnerability impacts Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (21H2, 22H2), Windows RT 8.1, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Verify that every system running these versions has received the applicable cumulative update.
- Implement defense-in-depth measures against privilege escalation. Enable Windows Credential Guard, enforce Mandatory Integrity Control (MIC) policies, and apply application control policies (such as WDAC or AppLocker) to limit the execution of untrusted code that could serve as the initial vector for reaching the ALPC vulnerability.
- Monitor for indicators of privilege escalation. Review Windows Security Event Logs for unusual token manipulation (Event IDs 4672, 4673), unexpected SYSTEM-level process creation, or signs of sandbox escape activity. Investigate any anomalous ALPC-related activity in process monitoring tools.
- Harden against use-after-free exploitation. As a long-term measure, enable Exploit Protection features in Windows Security settings, including hardware-enforced stack protection and control flow guard, which can mitigate exploitation of memory corruption vulnerabilities like use-after-free.
Technical Details
CVE-2023-21674 is a use-after-free vulnerability (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) subsystem, a high-performance inter-process communication mechanism used extensively within the Windows kernel and user-mode services. The vulnerability arises when the ALPC handler accesses a memory object after it has been deallocated, allowing an attacker to place controlled data in the freed memory region and hijack the subsequent pointer dereference to achieve arbitrary code execution at elevated privilege levels. The local attack vector (AV:L) requires the attacker to already have code execution on the system, typically achieved through a compromised browser or application. Low attack complexity (AC:L) indicates that the use-after-free condition is reliably triggerable without requiring precise timing. The changed scope (S:C) is particularly significant, as it confirms that the vulnerability enables cross-boundary escalation — an attacker operating within a sandboxed process can escape to SYSTEM-level privileges, bypassing the security boundary of the vulnerable ALPC component.
Frequently Asked Questions
Is CVE-2023-21674 being actively exploited?
Yes, CVE-2023-21674 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 31, 2023. The vulnerability has been observed in targeted attacks, potentially as part of browser sandbox escape chains. The EPSS score of 12.4% (93.75th percentile) confirms above-average exploitation activity.
What products are affected by CVE-2023-21674?
CVE-2023-21674 affects a broad range of Microsoft Windows products: Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), Windows RT 8.1, and Windows Server 2012, 2016, 2019, and 2022. Both client and server editions of Windows are vulnerable.
How do I fix CVE-2023-21674?
Apply the January 2023 cumulative security updates from Microsoft for all affected Windows versions. Additionally, enable Exploit Protection features, enforce application control policies, and monitor for privilege escalation indicators. See the Remediation section for a complete step-by-step guide.
How severe is CVE-2023-21674?
CVE-2023-21674 is rated High severity with a CVSS v3.1 score of 8.8 out of 10. The changed scope (S:C) means it can break through security boundaries such as browser sandboxes. Combined with high impact across confidentiality, integrity, and availability, and confirmed active exploitation, this vulnerability poses a serious risk to all affected Windows environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.