CVE-2023-29360
Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability
Description
CVE-2023-29360 is an Elevation of Privilege vulnerability in the Microsoft Streaming Service component of Microsoft Windows, classified under CWE-822 (Untrusted Pointer Dereference). The flaw affects a wide range of Microsoft Windows versions — from Windows 10 1607 through Windows 11 22H2 and Windows Server 2016 through 2022 — and allows a local attacker without any prior privileges to gain elevated system access. An attacker who successfully exploits CVE-2023-29360 can fully compromise the confidentiality, integrity, and availability of the affected system. CISA has confirmed active exploitation of this vulnerability in the wild, and with an EPSS score of 22.1% (95.7th percentile), the risk of exploitation remains significant for unpatched systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.5989 |
| microsoft | windows 10 1809 | < 10.0.17763.4499 |
| microsoft | windows 10 21h2 | < 10.0.19044.3086 |
| microsoft | windows 10 22h2 | < 10.0.19045.3086 |
| microsoft | windows 11 21h2 | < 10.0.22000.2057 |
| microsoft | windows 11 22h2 | < 10.0.22621.1848 |
| microsoft | windows server 2016 | < 10.0.14393.5989 |
| microsoft | windows server 2019 | < 10.0.17763.4499 |
| microsoft | windows server 2022 | < 10.0.20348.1784 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29360(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29360(US Government Resource)
Weakness Type
CWE-822: Untrusted Pointer Dereference
CWE-822 describes a condition in which software dereferences a pointer obtained from an untrusted source without first validating the pointer's target memory address. In CVE-2023-29360, the Microsoft Streaming Service dereferences a user-supplied pointer in kernel context, enabling an attacker with no prior privileges to redirect execution to arbitrary memory and escalate to a higher privilege level.
Learn more: CWE-822 — Untrusted Pointer Dereference
Impact Analysis
CVE-2023-29360 carries a CVSS 3.1 score of 8.4 (HIGH) and is particularly dangerous because no authentication or prior privileges are required — a completely unprivileged local user can exploit this vulnerability without any user interaction from a victim. Confidentiality (High): All data on the system becomes accessible to the attacker after privilege escalation to SYSTEM. Integrity (High): The attacker can modify operating system files, security policies, and application configurations. Availability (High): Critical services can be disrupted or the system rendered inoperable. CISA's inclusion of this vulnerability in the KEV catalog confirms exploitation by real threat actors, and the EPSS score of 22.1% (95.7th percentile) indicates a materially elevated probability of exploitation compared to the broader vulnerability population.
Exploit Maturity
CISA has confirmed that CVE-2023-29360 is being actively exploited in the wild, as evidenced by its inclusion in the Known Exploited Vulnerabilities catalog with a remediation due date of March 21, 2024. The ransomware association is listed as Unknown for this specific entry. No exploit URLs tagged as "Exploit" appear in the provided references, but the confirmed active exploitation by CISA and an EPSS score of 22.1% (95.7th percentile) indicate that functional exploits are in use by threat actors. Organizations with unpatched Windows systems running the Microsoft Streaming Service should treat this as a high-priority remediation.
Remediation
- Apply the Microsoft security patch for CVE-2023-29360 as directed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29360. CISA's required action states: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Prioritize patching across all affected Windows versions: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2), Windows Server 2016, Windows Server 2019, and Windows Server 2022.
- Restrict local user access on multi-user systems; since no privileges are required to exploit this flaw, any local session represents an attack surface. Apply least-privilege principles and limit interactive logon rights.
- Monitor Windows event logs for indicators of privilege escalation (Event IDs 4672, 4673, 4624 with elevated privileges) and unusual behavior from the Microsoft Streaming Service process. Deploy EDR solutions capable of detecting kernel-level anomalies.
- Audit and disable the Microsoft Streaming Service on systems where it is not required, reducing the attack surface until patching can be completed.
Technical Details
CVE-2023-29360 exploits an untrusted pointer dereference (CWE-822) within the Microsoft Streaming Service, a Windows kernel-mode component responsible for multimedia streaming operations. The vulnerability arises when the service processes a user-supplied pointer value without performing adequate validation of the memory address it references, enabling user-mode code to redirect kernel execution to an attacker-controlled memory region. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires only local access with no privileges and no user interaction, with low attack complexity — making it straightforward for any local user or process to weaponize. The scope is unchanged (S:U), but the impact at the kernel level is total: full confidentiality, integrity, and availability compromise of the host system.
Frequently Asked Questions
Is CVE-2023-29360 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-29360 in the wild by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 22.1% (95.7th percentile) reflects a high probability of exploitation relative to the overall vulnerability population. While a ransomware association has not been explicitly confirmed for this entry, the active exploitation status demands urgent action.
What products are affected by CVE-2023-29360?
CVE-2023-29360 affects Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), Windows Server 2016, Windows Server 2019, and Windows Server 2022. Any system running these versions without the relevant security patch is vulnerable to local privilege escalation via the Microsoft Streaming Service.
How do I fix CVE-2023-29360?
Apply the Microsoft security update for CVE-2023-29360 available through Windows Update or the Microsoft Security Response Center. Ensure all affected Windows 10, Windows 11, and Windows Server systems are patched. On systems where the Microsoft Streaming Service is not needed, consider disabling it as an interim mitigation.
How severe is CVE-2023-29360?
CVE-2023-29360 is rated HIGH with a CVSS 3.1 score of 8.4, reflecting the ability of a completely unprivileged local user to gain full control over a Windows system. The EPSS score of 22.1% (95.7th percentile) highlights that this vulnerability is actively targeted at a rate significantly above average, making it a priority for all organizations running affected Windows versions.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.