CVE-2023-36874

CVE-2023-36874 is a privilege escalation vulnerability in the Microsoft Windows Error Reporting Service, associated with improper handling of linked resources (CWE-59), that allows a local attacker to elevate privileges beyond their current user context. It is triggered when an attacker who can already execute code on a target Windows machine interacts with the Error Reporting Service such that the service processes attacker-influenced files or links in a way that grants it unintended access. Successful exploitation yields elevated privileges on the host, a common post-compromise step used to chain with malware or other exploits to disable defenses and move laterally. Any Windows system running the Error Reporting Service is affected — effectively all supported Windows client and server releases per CISA, though specific version ranges are not enumerated in the source data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-07-11, confirming exploitation in the wild; no public proof-of-concept is documented, ransomware use is unknown, and EPSS estimates a 43.4% probability of exploitation within 30 days (99th percentile).

What to do: Apply the Microsoft security updates that fix CVE-2023-36874 (July 2023 Windows security updates or any later cumulative update) on all Windows endpoints and servers, prioritizing hosts where untrusted users have interactive logon (RDS/VDI, kiosks, jump servers). Because the flaw requires local access, limiting interactive logon rights on shared systems reduces risk as a compensating measure. Federal agencies must patch within CISA's standard two-week KEV remediation timeline from the 2023-07-11 listing.