CVE-2023-36884
Microsoft Windows Search Remote Code Execution Vulnerability
Description
CVE-2023-36884 is a remote code execution vulnerability in Microsoft Windows Search that is caused by a race condition weakness. This vulnerability affects a wide range of Microsoft Windows versions, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. An attacker who successfully exploits CVE-2023-36884 can execute arbitrary code on the target system, though the attack requires user interaction and involves high attack complexity. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog and confirmed its use in ransomware campaigns, making it a significant security threat. With an EPSS score of 93.2% and a CVSS score of 7.5 (High severity), CVE-2023-36884 demands urgent attention from organizations running affected Windows versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20107 |
| microsoft | windows 10 1607 | < 10.0.14393.6167 |
| microsoft | windows 10 1809 | < 10.0.17763.4737 |
| microsoft | windows 10 21h2 | < 10.0.19044.3324 |
| microsoft | windows 10 22h2 | < 10.0.19044.3324 |
| microsoft | windows 11 21h2 | < 10.0.22000.2295 |
| microsoft | windows 11 22h2 | < 10.0.22621.2134 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6167 |
| microsoft | windows server 2019 | < 10.0.17763.4737 |
| microsoft | windows server 2022 | < 10.0.20348.1903 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884(Patch, Vendor Advisory)
- http://seclists.org/fulldisclosure/2023/Jul/43(Broken Link, Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36884(US Government Resource)
Weakness Type
CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition')
A race condition vulnerability occurs when a system's behavior depends on the timing or ordering of events, and an attacker can manipulate this timing to cause unintended outcomes. In CVE-2023-36884, the Windows Search component contains a race condition that an attacker can exploit to achieve remote code execution, taking advantage of improper synchronization in how Windows handles search-related operations.
Learn more: CWE-362 — Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition')
Impact Analysis
CVE-2023-36884 is remotely exploitable without physical access via a network-based attack vector. However, exploitation requires high attack complexity, meaning specific conditions must be met for a successful attack, and user interaction is required — a victim must take an action such as opening a malicious document or clicking a link. No authentication is needed to initiate the attack. Confidentiality (High): A successful exploit gives the attacker access to sensitive data on the compromised Windows system, including files, credentials, and memory contents. Integrity (High): The attacker can modify system files, install malware, and alter system configurations. Availability (High): Full code execution enables the attacker to disrupt services, crash processes, or render the system inoperable. With a CVSS score of 7.5 (High severity) and an EPSS score of 93.2%, this vulnerability is actively exploited at scale. The confirmed association with ransomware campaigns makes CVE-2023-36884 particularly dangerous, as attackers leverage the Windows Search remote code execution to deploy ransomware payloads across enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36884 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 29, 2023, and this vulnerability has been used in ransomware campaigns. The EPSS score of 93.2% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity. While no public exploit code tagged as an exploit appears in the NVD references, Microsoft has published a patch through MSRC and the confirmed active exploitation combined with ransomware usage demonstrates that threat actors possess working exploits for this Windows Search vulnerability.
Remediation
- Apply Microsoft security updates immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Download and install the patches from the Microsoft Security Response Center update guide.
- Patch all affected Windows versions, including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server (2008, 2012, 2016, 2019, 2022). Prioritize internet-facing systems and those with elevated privileges.
- Implement attack surface reduction rules to block Office applications from creating child processes and from creating executable content. Configure Windows Defender Attack Surface Reduction (ASR) rules and restrict the execution of potentially dangerous file types delivered via email or web downloads.
- Monitor endpoints for indicators of compromise, including suspicious Windows Search protocol handler invocations, unexpected process creation chains originating from search operations, and unusual network connections following document opens. Deploy EDR monitoring focused on the exploitation pattern.
- Enforce defense-in-depth measures against race condition exploitation by deploying application control policies (e.g., Windows Defender Application Control), restricting user permissions to the principle of least privilege, and ensuring that email and web gateways filter potentially malicious documents before they reach end users.
Technical Details
CVE-2023-36884 exploits a race condition (CWE-362) in the Microsoft Windows Search component to achieve remote code execution. The vulnerability arises from improper synchronization in concurrent execution paths within the Windows Search functionality, where an attacker can manipulate the timing of operations to inject and execute arbitrary code. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that while the attack is network-based and requires no privileges, it demands high attack complexity — the attacker must win a race condition — and requires user interaction, typically through a victim opening a specially crafted document. Once the race condition is successfully triggered, the attacker achieves full code execution with high impact on confidentiality, integrity, and availability, enabling complete system compromise within the scope of the vulnerable Windows component.
Frequently Asked Questions
Is CVE-2023-36884 being actively exploited?
Yes, CVE-2023-36884 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 29, 2023. This vulnerability has been confirmed in ransomware campaigns, and its EPSS score of 93.2% (99.8th percentile) indicates widespread exploitation.
What products are affected by CVE-2023-36884?
CVE-2023-36884 affects a broad range of Microsoft Windows products including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server editions 2008, 2012, 2016, 2019, and 2022. All supported versions of these products that have not been patched are vulnerable.
How do I fix CVE-2023-36884?
Apply the security updates provided by Microsoft through the MSRC update guide for CVE-2023-36884. Prioritize patching all affected Windows 10, Windows 11, and Windows Server systems. As interim mitigation, implement Attack Surface Reduction rules to restrict Office applications from spawning child processes or creating executable content.
How severe is CVE-2023-36884?
CVE-2023-36884 is rated High severity with a CVSS score of 7.5. Its EPSS score of 93.2% places it in the 99.8th percentile of exploited vulnerabilities, and its confirmed use in ransomware campaigns significantly elevates the real-world threat. Despite requiring user interaction and high attack complexity, the widespread exploitation demonstrates that attackers have reliable methods to trigger this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.