CVE-2023-32046

CVE-2023-32046 is an elevation of privilege vulnerability in the Windows MSHTML platform, the legacy Trident web-rendering component embedded in Windows that many applications (including Office and other HTML-rendering software) use to display web content. An attacker triggers the flaw by convincing a user to open attacker-supplied content that is rendered through MSHTML, such as a malicious file or link; the attack vector is local and requires user interaction but no privileges. Successful exploitation lets the attacker elevate privileges on the victim system with high impact on confidentiality, integrity, and availability. All supported Windows client and server releases are affected, spanning Windows 10, Windows 11, and Windows Server. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-07-11 as part of the July 2023 Patch Tuesday zero-day set, and it carries a 10% EPSS probability of exploitation within 30 days.

What to do: Apply the July 2023 (or later) Microsoft cumulative Windows security updates to all affected Windows 10, Windows 11, and Windows Server systems; CISA requires US civilian agencies to patch by August 1, 2023. Prioritize user workstations and shared systems, since exploitation requires user interaction, and verify remediation against KEV and patch-inventory tooling. Because MSHTML renders content for many applications, reinforce user awareness around opening untrusted files and links while patching completes.