CVE-2023-36802
Microsoft Streaming Service Proxy Privilege Escalation Vulnerability
Description
CVE-2023-36802 is an elevation of privilege vulnerability in the Microsoft Streaming Service Proxy caused by a use-after-free memory corruption flaw. A local attacker with low-level privileges can exploit this vulnerability to escalate privileges to SYSTEM level on affected Windows systems, gaining full control over the target machine. The vulnerability affects multiple versions of Microsoft Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022. CISA has confirmed active exploitation of CVE-2023-36802 in the wild, and the EPSS score of 75.4% indicates a very high probability of exploitation, making this a critical priority for patching.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.4851 |
| microsoft | windows 10 21h2 | < 10.0.19044.3448 |
| microsoft | windows 10 22h2 | < 10.0.19045.3448 |
| microsoft | windows 11 21h2 | < 10.0.22000.2416 |
| microsoft | windows 11 22h2 | < 10.0.22621.2275 |
| microsoft | windows server 2019 | < 10.0.17763.4851 |
| microsoft | windows server 2022 | < 10.0.20348.1970 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36802(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2023-36802 exploits a use-after-free condition in the Microsoft Streaming Service Proxy, where the software continues to reference memory after it has been freed. In the context of this vulnerability, the freed memory can be reallocated and manipulated by an attacker to corrupt kernel data structures, enabling arbitrary code execution with elevated SYSTEM privileges.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-36802 requires local access to exploit, meaning the attacker must already have some level of access to the target system, either through a prior compromise or legitimate low-privilege account. Attack Complexity (Low): no special conditions or preparation are needed to exploit the vulnerability once local access is obtained. Privileges Required (Low): only a standard user account is needed, making this accessible to any authenticated user on the system. User Interaction (None): no action from other users is required for exploitation. Confidentiality (High): elevation to SYSTEM level grants access to all data on the system, including credentials, security policies, and sensitive files. Integrity (High): SYSTEM privileges allow unrestricted modification of system configurations, security settings, and any files on the system. Availability (High): the attacker can disrupt services, crash the system, or install persistent backdoors. With a CVSS score of 7.8 (High) and an EPSS score of 75.4% placing it in the 98.9th percentile, CVE-2023-36802 is highly likely to be exploited and is commonly chained with remote access vulnerabilities to achieve full system compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36802 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 3, 2023. The EPSS score of 75.4% places this vulnerability in the 98.9th percentile, indicating a very high probability of exploitation activity. While no specific public exploit code is tagged in the available references, the confirmed active exploitation combined with the extremely high EPSS score demonstrates that threat actors have developed reliable exploitation techniques for this use-after-free vulnerability in the Microsoft Streaming Service Proxy. Microsoft has released a security update to address this flaw.
Remediation
- Apply Microsoft security updates immediately: Install the patches from the Microsoft Security Update Guide for CVE-2023-36802 across all affected systems. CISA required remediation by October 3, 2023.
- Prioritize patching by Windows version: Update all affected Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2), Windows Server 2019, and Windows Server 2022. Focus first on internet-facing servers and systems with higher exposure risk.
- Restrict local access and enforce least privilege: Limit local logon rights to only users who require them, as CVE-2023-36802 requires local access with low privileges. Review and tighten group policy settings governing local logon and service account permissions to reduce the pool of potential attackers.
- Monitor for privilege escalation indicators: Deploy endpoint detection and response (EDR) rules to detect anomalous privilege escalation patterns, including unexpected SYSTEM-level process creation from low-privilege user contexts and suspicious interactions with the Microsoft Streaming Service Proxy driver.
- Implement kernel exploit mitigations: Enable and verify Windows kernel exploit protection features such as Kernel Data Protection (KDP), Hypervisor-Protected Code Integrity (HVCI), and Credential Guard where supported, to increase the difficulty of exploiting use-after-free vulnerabilities at the kernel level.
Technical Details
CVE-2023-36802 is a use-after-free vulnerability (CWE-416) in the Microsoft Streaming Service Proxy, a kernel-mode component that handles multimedia streaming operations in Windows. The vulnerability occurs when the service proxy frees a memory object but retains a dangling pointer that can subsequently be dereferenced, allowing an attacker to reclaim the freed memory with controlled data and manipulate kernel execution flow to achieve privilege escalation from a standard user to SYSTEM. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that this is a local attack with low complexity requiring only low privileges and no user interaction, with full impact across all three security pillars. The scope is unchanged, meaning the elevated privileges are within the same security authority (the Windows kernel), but achieving SYSTEM-level access effectively grants unrestricted control over the operating system. Use-after-free vulnerabilities in kernel components are particularly dangerous because they operate in ring 0, where memory corruption can bypass user-mode security controls and directly manipulate security tokens, process structures, and access control mechanisms.
Frequently Asked Questions
Is CVE-2023-36802 being actively exploited?
Yes, CVE-2023-36802 is being actively exploited in the wild. CISA has confirmed active exploitation and added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline of October 3, 2023. The EPSS score of 75.4% further confirms the very high likelihood of exploitation.
What products are affected by CVE-2023-36802?
CVE-2023-36802 affects Microsoft Windows 10 versions 1809, 21H2, and 22H2, Microsoft Windows 11 versions 21H2 and 22H2, Microsoft Windows Server 2019, and Microsoft Windows Server 2022. All of these versions are vulnerable until the security update is applied.
How do I fix CVE-2023-36802?
Install the security updates published by Microsoft through the Security Update Guide for CVE-2023-36802. Prioritize patching across all affected Windows versions, enforce least-privilege access policies, and enable kernel exploit mitigation features such as HVCI and Credential Guard.
How severe is CVE-2023-36802?
CVE-2023-36802 has a CVSS score of 7.8 (High severity) with full impact on confidentiality, integrity, and availability through privilege escalation to SYSTEM level. The EPSS score of 75.4% places it in the 98.9th percentile, indicating an extremely high probability of exploitation, making this one of the most critical local privilege escalation vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.