CVE-2023-21823
Microsoft Windows Graphic Component Privilege Escalation Vulnerability
Description
CVE-2023-21823 is a remote code execution vulnerability in the Windows Graphics Component caused by an integer overflow. This vulnerability affects numerous Microsoft Windows versions including Windows 10, Windows 11, and Windows Server 2008 through 2022. An attacker who successfully exploits this integer overflow flaw can execute arbitrary code with elevated privileges, potentially gaining full control of the affected system. CISA has added CVE-2023-21823 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With a CVSS score of 7.8 (High) and an EPSS score of 4.2% (88th percentile), this Windows Graphics Component vulnerability demands prompt patching across enterprise environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19747 |
| microsoft | windows 10 1607 | < 10.0.14393.5717 |
| microsoft | windows 10 1809 | < 10.0.17763.4010 |
| microsoft | windows 10 20h2 | < 10.0.19042.2604 |
| microsoft | windows 10 21h2 | < 10.0.19044.2604 |
| microsoft | windows 10 22h2 | < 10.0.19045.2604 |
| microsoft | windows 11 21h2 | < 10.0.22000.1574 |
| microsoft | windows 11 22h2 | < 10.0.22621.1265 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 2022 | - |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21823(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
Integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum size of the integer type used to store it, causing the value to wrap around. In CVE-2023-21823, the Windows Graphics Component fails to properly validate integer values during graphics processing operations, enabling an attacker to trigger an overflow condition that corrupts memory and leads to arbitrary code execution.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
Attack Vector (Local): CVE-2023-21823 requires local access to the target system, meaning an attacker needs an initial foothold such as a compromised user account or delivery of a malicious file. Attack Complexity (Low): Exploitation is straightforward with no special conditions or configurations needed. Privileges Required (Low): Only standard user privileges are required to trigger the vulnerability, and no user interaction is necessary, allowing the exploit to execute without any action from the logged-in user. Confidentiality, Integrity, and Availability (all High): Successful exploitation enables arbitrary code execution with elevated privileges, granting the attacker complete access to data, the ability to modify system configurations, and the power to disrupt system availability. The CVSS score of 7.8 (High severity) reflects the serious nature of this vulnerability. The EPSS score of 4.2% places it in the 88th percentile, indicating a notable probability of exploitation that is further validated by CISA confirming active in-the-wild exploitation.
Exploit Maturity
Active exploitation of CVE-2023-21823 has been confirmed by CISA, which added this Windows Graphics Component vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. The EPSS score of 4.2% (88th percentile) indicates a meaningful probability of exploitation activity. While no specific ransomware association has been reported for this vulnerability, the confirmed active exploitation underscores the need for immediate patching. No public proof-of-concept exploit code has been identified in tracked reference sources, suggesting that exploitation may be limited to sophisticated threat actors with privately developed exploit capabilities.
Remediation
- Apply Microsoft security updates immediately. Install the February 2023 Patch Tuesday update that addresses CVE-2023-21823 for all affected Windows versions. As directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Consult the Microsoft Security Update Guide for version-specific patches.
- Patch all Windows systems comprehensively. This vulnerability affects Windows 10 (versions 1507 through 22H2), Windows 11 (21H2 and 22H2), and Windows Server 2008 through 2022. Ensure complete coverage across your fleet, including older Server 2008 and 2012 installations that may still be in service.
- Restrict local access and enforce least privilege. Since the vulnerability requires local access with low privileges, minimize the attack surface by limiting user account permissions, implementing application control policies, and disabling unnecessary local services.
- Monitor for unusual graphics processing activity. Watch for unexpected process behavior related to Windows Graphics Component operations, anomalous memory usage in graphics drivers, and signs of privilege escalation. Deploy EDR solutions configured to detect exploitation of graphics subsystem vulnerabilities.
- Implement defense-in-depth with input validation practices. As an integer overflow vulnerability, ensure that development teams handling graphics data follow secure coding practices including proper bounds checking and safe integer arithmetic, reducing the risk of similar vulnerabilities in custom applications.
Technical Details
Vulnerability Mechanism: CVE-2023-21823 resides in the Windows Graphics Component, a core system component responsible for rendering visual content. The vulnerability is caused by an integer overflow (CWE-190) where the graphics component fails to validate integer values used in memory allocation or buffer size calculations during graphics processing. When an arithmetic operation produces a result larger than the maximum representable value, the integer wraps around to a small or negative number, leading to an undersized buffer allocation. Exploitation Path: An attacker with local access and standard user privileges crafts input that triggers the integer overflow condition in the graphics component. The resulting undersized buffer is then overflowed with attacker-controlled data, corrupting adjacent memory and enabling arbitrary code execution with elevated privileges. CVSS Vector Analysis: The vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that while local access is required, the low attack complexity, minimal privilege requirements, and absence of user interaction make this a reliable exploit once the attacker has any level of access to the system.
Frequently Asked Questions
Is CVE-2023-21823 being actively exploited?
Yes, CVE-2023-21823 is being actively exploited in the wild. CISA has confirmed active exploitation by adding this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. No specific ransomware association has been reported at this time.
What products are affected by CVE-2023-21823?
CVE-2023-21823 affects a wide range of Microsoft Windows products including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Both client and server editions of Windows are vulnerable.
How do I fix CVE-2023-21823?
Apply the February 2023 security update from Microsoft for all affected Windows versions. Refer to the Microsoft Security Update Guide for version-specific patch details. In the interim, restrict local user privileges, implement application control policies, and monitor for signs of privilege escalation or anomalous graphics component behavior.
How severe is CVE-2023-21823?
CVE-2023-21823 has a CVSS score of 7.8 (High severity), reflecting the potential for arbitrary code execution with elevated privileges. The EPSS score of 4.2% places it in the 88th percentile of exploitation probability. Combined with CISA-confirmed active exploitation, this vulnerability should be prioritized for immediate patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.