CVE-2023-36563
Microsoft WordPad Information Disclosure Vulnerability
Description
CVE-2023-36563 is a medium-severity information disclosure vulnerability in Microsoft WordPad caused by improper input validation. The vulnerability allows an unauthenticated, remote attacker to disclose sensitive information — such as NTLM hashes — when a victim opens a specially crafted file in WordPad. Exploitation requires user interaction, as the victim must open a malicious document for the information disclosure to occur. CVE-2023-36563 affects a wide range of Microsoft Windows versions including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and the EPSS score of 2.5% indicates a moderate probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20232 |
| microsoft | windows 10 1607 | < 10.0.14393.6351 |
| microsoft | windows 10 1809 | < 10.0.17763.4974 |
| microsoft | windows 10 21h2 | < 10.0.19041.3570 |
| microsoft | windows 10 22h2 | < 10.0.19045.3570 |
| microsoft | windows 11 21h2 | < 10.0.22000.2538 |
| microsoft | windows 11 22h2 | < 10.0.22621.2428 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6351 |
| microsoft | windows server 2019 | < 10.0.17763.4974 |
| microsoft | windows server 2022 | < 10.0.20348.2031 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36563(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36563(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper input validation occurs when a program does not properly validate or sanitize user-supplied input before processing it, potentially leading to unexpected behavior such as information disclosure or code execution. In CVE-2023-36563, Microsoft WordPad fails to adequately validate certain input within crafted documents, causing the application to disclose sensitive information such as NTLM credential hashes to an attacker-controlled destination.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2023-36563 carries a CVSS score of 6.5 (Medium), reflecting a significant confidentiality impact offset by the requirement for user interaction. The vulnerability is remotely exploitable without physical access and requires no authentication, with easy exploitation conditions (low attack complexity). User Interaction (Required): the victim must open a malicious file in Microsoft WordPad, which is the primary barrier to exploitation. Confidentiality (High): successful exploitation can disclose highly sensitive information such as NTLM credential hashes, which can be used for pass-the-hash attacks or offline password cracking. Integrity (None): the vulnerability does not allow data modification. Availability (None): exploiting this flaw does not impact system availability. The broad range of affected Windows versions — spanning Windows 10, Windows 11, and multiple Windows Server editions from 2008 to 2022 — significantly increases the potential attack surface. With an EPSS score of 2.5% placing it in the 85th percentile, exploitation is possible and confirmed active by CISA.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36563 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 2.5% suggests that exploitation is occurring but is not yet widespread, likely because the attack requires user interaction (opening a malicious file). While the ransomware association is currently listed as unknown, the ability to capture NTLM hashes through this information disclosure vulnerability makes it a valuable tool for lateral movement in targeted attacks. Microsoft has published a patch and advisory at the Microsoft Security Response Center.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Microsoft has released a security update addressing CVE-2023-36563 — apply the patch from the Microsoft Security Response Center to all affected Windows systems.
- Patch all affected Windows versions including Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server editions (2008, 2012, 2016, 2019, 2022). Prioritize systems where WordPad is used or accessible to end users.
- Consider removing or disabling Microsoft WordPad on systems where it is not required. Microsoft has announced plans to deprecate WordPad, and removing it eliminates this attack vector entirely. Alternatively, configure file type associations to open RTF and other document formats in more secure applications.
- Implement NTLM relay protections such as enabling SMB signing, enforcing NTLMv2 authentication, and configuring outbound SMB traffic restrictions to prevent NTLM hash capture from reaching attacker-controlled servers. Block outbound SMB connections (port 445) to untrusted networks at the firewall level.
- Educate users about the risk of opening untrusted documents in WordPad and monitor for suspicious outbound authentication attempts from endpoints, particularly NTLM authentication to external or unfamiliar destinations.
Technical Details
CVE-2023-36563 is an information disclosure vulnerability in Microsoft WordPad caused by improper input validation (CWE-20), where the application fails to properly sanitize certain elements within crafted documents, resulting in unintended disclosure of sensitive information. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates that the vulnerability is network-accessible with low attack complexity and requires no privileges, though user interaction is required to open the malicious file. When a victim opens a specially crafted document in WordPad, the improper input validation causes the application to initiate outbound authentication requests, potentially leaking NTLM credential hashes to an attacker-controlled server. The scope remains unchanged and only confidentiality is impacted (high), with no effect on integrity or availability, classifying this firmly as an information disclosure vulnerability rather than a code execution flaw.
Frequently Asked Questions
Is CVE-2023-36563 being actively exploited?
Yes, CVE-2023-36563 is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 2.5% confirms that exploitation is occurring, though it is not yet widespread. Ransomware association is currently listed as unknown.
What products are affected by CVE-2023-36563?
CVE-2023-36563 affects Microsoft WordPad across a wide range of Windows versions including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server editions (2008, 2012, 2016, 2019, 2022). Any system with WordPad installed and accessible is potentially vulnerable.
How do I fix CVE-2023-36563?
Apply the security update from Microsoft available through the Microsoft Security Response Center update guide for all affected Windows versions. As an additional mitigation, consider removing or disabling WordPad on systems where it is not needed, and implement NTLM relay protections such as SMB signing and outbound SMB blocking.
How severe is CVE-2023-36563?
CVE-2023-36563 is rated Medium severity with a CVSS score of 6.5 out of 10.0. The vulnerability enables disclosure of sensitive information such as NTLM credential hashes, which can be leveraged for lateral movement in follow-up attacks. It ranks in the 85th percentile for exploitation probability (EPSS score of 2.5%), and its broad impact across many Windows versions increases the overall risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.