CISA adds Microsoft Streaming Service bug to its Known Exploited Vulnerabilities catalog

CVE-2023-29360 is an untrusted pointer dereference (CWE-822) in the Microsoft Streaming Service, the kernel-level streaming component that ships with Windows. A local attacker who can run code on an affected system can trigger the flaw to dereference an attacker-controlled pointer, elevating their privileges from an ordinary user to SYSTEM. Successful exploitation gives the attacker full control of the host, making it a useful post-compromise step for threat actors, including in ransomware chains (CISA notes ransomware use as unknown). Any Windows system that includes the Microsoft Streaming Service is affected; the vulnerability was addressed by Microsoft's security updates in 2023. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-02-29, and EPSS estimates a 22.1% probability of exploitation in the next 30 days (98th percentile).

Do: Apply Microsoft's June 2023 (or later) security updates on all Windows client and server hosts, per the CISA required action to apply vendor mitigations or discontinue use; there is no indication of a workaround, so patching is the primary mitigation. Prioritize systems where local privilege escalation has real impact — multi-user endpoints, RDP-exposed servers, and hosts with evidence of prior compromise — since exploitation requires local execution. Confirm patch levels against Microsoft's advisories and treat the KEV listing as a remediation deadline for your environment.