CVE-2023-36033
Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
Description
CVE-2023-36033 is a high-severity elevation of privilege vulnerability in the Windows Desktop Window Manager (DWM) Core Library. This flaw involves an untrusted pointer dereference and improper restriction of operations within a memory buffer, allowing a local attacker with low-level privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server. CISA has confirmed active exploitation of CVE-2023-36033 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023, underscoring the urgency of patching.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.5122 |
| microsoft | windows 10 21h2 | < 10.0.19041.3693 |
| microsoft | windows 10 22h2 | < 10.0.19045.3693 |
| microsoft | windows 11 21h2 | < 10.0.22000.2600 |
| microsoft | windows 11 22h2 | < 10.0.22621.2715 |
| microsoft | windows 11 23h2 | < 10.0.22621.2715 |
| microsoft | windows server 2019 | < 10.0.17763.5122 |
| microsoft | windows server 2022 | < 10.0.20348.2113 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.531 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36033(US Government Resource)
Weakness Type
CWE-822: Untrusted Pointer Dereference
CWE-822 describes a weakness where software dereferences a pointer that is supplied by an untrusted source or has not been properly validated. In CVE-2023-36033, the Windows DWM Core Library processes pointer values without adequate validation, allowing a local attacker to manipulate memory references and gain elevated privileges.
Learn more: CWE-822 — Untrusted Pointer Dereference
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 covers vulnerabilities where software performs operations on a memory buffer without properly restricting read or write boundaries. In the context of CVE-2023-36033, this weakness enables the attacker to perform out-of-bounds memory operations within the DWM Core Library, contributing to the privilege escalation attack.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2023-36033 carries a CVSS v3.1 base score of 7.8 (High severity), reflecting serious risk for local privilege escalation. The vulnerability requires local access to the target system, meaning the attacker must already have a foothold on the machine, such as through a compromised user account or a separate initial access vulnerability. Attack Complexity (Low): Exploitation is straightforward with no special conditions or race conditions required. Privileges Required (Low): The attacker needs only basic user-level privileges to trigger the vulnerability, making it accessible to any authenticated user on the system. User Interaction (None): No action from another user is required for the attack to succeed. Confidentiality (High): Successful exploitation grants full read access to all data on the system, including credentials, sensitive files, and protected system information. Integrity (High): The attacker can modify system files, install persistent backdoors, and alter security configurations. Availability (High): The attacker can destabilize or crash the system. Although the EPSS score of 0.9% is relatively low, CISA has confirmed active exploitation, indicating that threat actors are using this vulnerability in targeted attacks, often as part of post-exploitation chains where initial access has already been obtained.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36033 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023. Although the EPSS score of 0.9% (75th percentile) suggests exploitation is not yet widespread, the confirmed active exploitation status indicates that threat actors are leveraging this vulnerability in targeted attack scenarios, likely as a privilege escalation step after obtaining initial access through another vector. The ransomware association is currently listed as unknown, but local privilege escalation vulnerabilities like CVE-2023-36033 are commonly used in ransomware attack chains to gain the SYSTEM-level access needed for encryption operations.
Remediation
- Apply Microsoft security updates immediately. Install the patches referenced in the Microsoft Security Response Center advisory for CVE-2023-36033 across all affected systems. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Patch all affected Windows versions, including Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2019, 2022, 2022 23H2). Prioritize systems that are internet-facing or host sensitive data, as they are more likely to have an attacker already present.
- Restrict local access and enforce least privilege. Limit local logon rights to only those users who require them, and enforce the principle of least privilege to reduce the number of accounts that could exploit this vulnerability. Use Local Security Policy or Group Policy to restrict interactive logon access.
- Monitor for privilege escalation indicators. Review Windows Event Logs for unusual process creation events running as SYSTEM, particularly those originating from low-privileged user contexts. Watch for unexpected DWM-related crashes or memory access violations that may indicate exploitation attempts.
- Implement endpoint detection and response (EDR) rules to detect exploitation patterns associated with DWM Core Library memory corruption, such as suspicious memory allocation patterns, untrusted pointer dereferences, and unexpected privilege transitions from user-level to SYSTEM-level processes.
Technical Details
CVE-2023-36033 is a local privilege escalation vulnerability in the Windows Desktop Window Manager (DWM) Core Library, stemming from two related memory safety weaknesses: untrusted pointer dereference (CWE-822) and improper restriction of operations within the bounds of a memory buffer (CWE-119). The DWM Core Library manages the composition and rendering of the Windows desktop, operating at a high privilege level. The vulnerability arises when the library processes memory references without properly validating pointer values, allowing a local attacker to supply crafted input that causes the library to dereference untrusted pointers and perform out-of-bounds memory operations. Attack Vector (Local): Exploitation requires the attacker to execute code on the target system, typically through a compromised user account or a chained initial access exploit. Attack Complexity (Low): The memory corruption can be triggered reliably without timing-dependent conditions. Privileges Required (Low): Only standard user-level access is needed to interact with the DWM Core Library in a way that triggers the vulnerability. Successful exploitation elevates the attacker from a low-privileged user context to SYSTEM-level privileges, granting full control over the affected Windows system including the ability to install software, create privileged accounts, and access all data.
Frequently Asked Questions
Is CVE-2023-36033 being actively exploited?
Yes, CVE-2023-36033 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023. While the EPSS score of 0.9% suggests exploitation is targeted rather than widespread, active exploitation has been confirmed and patching should be prioritized.
What products are affected by CVE-2023-36033?
CVE-2023-36033 affects multiple Microsoft Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2019, 2022, 2022 23H2). The vulnerability is in the DWM Core Library, which is a core component of the Windows desktop rendering engine.
How do I fix CVE-2023-36033?
Apply the security patches from the Microsoft Security Response Center advisory for CVE-2023-36033. Ensure all affected Windows versions are updated, prioritizing systems where attackers may already have local access. Additionally, enforce least privilege policies and deploy EDR monitoring for privilege escalation indicators.
How severe is CVE-2023-36033?
CVE-2023-36033 is rated High severity with a CVSS v3.1 base score of 7.8. While it requires local access and low-level privileges, exploitation leads to full SYSTEM-level control over the affected Windows system. The confirmed active exploitation by CISA elevates its practical risk significantly beyond what the CVSS score alone suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.