Buffer overflow in Microsoft Windows and Windows Server - CVE-2023-36802
Published: September 12, 2023 / Updated: June 21, 2024
Vulnerability identifier: #VU80658
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36802
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Microsoft Streaming Service Proxy. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2023-36802
Install updates from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #10106 - CVE-2023-36802 (Procedure to Recreate the Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver) (June 21, 2024)
- Exploit #9751 - CVE-2023-36802-MSKSSRV-LPE (PoC for CVE-2023-36802 Microsoft Kernel Streaming Service Proxy) (April 26, 2024)
- Exploit #9440 - cve-2023-36802 (Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver) (December 19, 2023)
- Exploit #9382 - Windows_MSKSSRV_LPE_CVE-2023-36802 (LPE exploit for CVE-2023-36802) (October 15, 2023)