CVE-2023-29324

—

CVSS 3.1

6.5 medium

EPSS

3%p86

Published

May 9, 2023 (May 9, 2023)

Modified

Jun 17, 2026

Description

Windows MSHTML Platform Security Feature Bypass Vulnerability

Vendors: microsoft
Products: windows 10 1507, windows 10 1607, windows 10 1809, windows 10 20h2, windows 10 21h2, windows 10 22h2, windows 11 21h2, windows 11 22h2, windows server 2008, windows server 2012, windows server 2016, windows server 2022
Weakness: CWE-73
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news10 stories

Beware: Experts Reveal New Details on Zero

The Hacker NewsDec 19, 04:44 UTC · Dec 19, 2023Vulnerability CVE-2023-35384 CVE-2023-36710 CVE-2023-23397+1 CVEs

60

Kaspersky malware report for Q3 2023

Kaspersky SecurelistDec 1, 16:01 UTC · Dec 1, 2023Malware CVE-2023-23397 CVE-2023-29324

60

Comprehensive analysis of initial attack samples exploiting CVE-2023

Kaspersky SecurelistJul 19, 12:00 UTC · Jul 19, 2023Exploit / PoC CVE-2023-23397 CVE-2023-29324

60

Week in review: Microsoft fixes two actively exploited bugs, MSI private code signing keys leaked

Help Net SecurityMay 14, 00:00 UTC · May 14, 2023Ransomware in the wildCVE-2023-29324 CVE-2023-29336 CVE-2023-24932

60

A zero-click flaw in Windows allows stealing NTLM credentials

Security AffairsMay 11, 07:23 UTC · May 11, 2023Vulnerability CVE-2023-29324 CVE-2023-23397

60

Experts Detail New Zero-Click Windows Vulnerability for NTLM Credential Theft

The Hacker NewsMay 11, 04:35 UTC · May 11, 2023Vulnerability CVE-2023-29324 CVE-2023-23397

60

Microsoft releases fix for patched Outlook issue exploited by Russian hackers

The RecordMay 10, 21:01 UTC · May 10, 2023Vulnerability in the wildCVE-2023-23397 CVE-2023-29324 CVE-2023-29336+1 CVEs

60

Easily bypassed patch makes zero-click Outlook flaw exploitable again (CVE-2023-29324)

Help Net SecurityMay 10, 00:00 UTC · May 10, 2023Vulnerability CVE-2023-29324 CVE-2023-23397

60

Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three

Cisco TalosMay 9, 17:47 UTC · May 9, 2023Vulnerability in the wildCVE-2023-29336 CVE-2023-24941 CVE-2023-29325+7 CVEs

60

Microsoft fixes two actively exploited bugs, one used by BlackLotus bootkit (CVE-2023-29336, CVE-2023-24932)

Help Net SecurityMay 9, 00:00 UTC · May 9, 2023Vulnerability in the wildCVE-2023-29336 CVE-2023-24932 CVE-2022-21882+10 CVEs1

60