CVE-2023-21823

CVE-2023-21823 is an integer overflow (CWE-190) in the Microsoft Windows Graphics Component that can lead to remote code execution; CISA characterizes it as a privilege escalation flaw in the same component. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N), exploitation requires an attacker to already be able to run code locally on the target — for example by getting a user to execute a malicious file — and requires only low privileges with no user interaction beyond that. A successful attack lets the adversary execute code in the context of the affected user and move on to broader actions such as malware installation, credential theft or ransomware staging. Essentially all supported Windows 10 releases (1507 through 22H2), Windows 11 21H2/22H2, and Windows Server 2008 through 2019 are affected, meaning the Windows ecosystem at large. The flaw was being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on Feb. 14, 2023, and Microsoft fixed it that day as one of three zero-days (alongside CVE-2023-21715 and CVE-2023-23376) in the February 2023 Patch Tuesday.

What to do: Apply the February 2023 Microsoft security updates (released Feb. 14, 2023) for your specific Windows 10/11 release and Windows Server version via Windows Update, WSUS, or the Microsoft Update Catalog, which is the required action under the CISA KEV listing. Prioritize systems where untrusted users can run code, such as workstations, VDI/terminal (RDS) servers and shared hosts. Confirm the patch is installed on all endpoints and review systems that were exposed while unpatched for signs of exploitation.