All vulnerabilities
CVE-2023-29360

Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

Microsoft Streaming Service
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationExploited in the wildAdded to KEV 29 Feb 2024CISA KEV
Exploit odds (EPSS)21.6%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.17763.4499Also 10.0.20348.1787, 10.0.22000.2057 and 4 moreCVE List
Federal deadline21 Mar 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 10.0.17763.4499Windows 10 Version 1809CVE List
  • 10.0.17763.4499Windows Server 2019CVE List
  • 10.0.17763.4499Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.1787Windows Server 2022CVE List
  • 10.0.22000.2057Windows 11 version 21H2CVE List
  • 10.0.19044.3086Windows 10 Version 21H2CVE List
Show all 11 fixed versions
  • 10.0.22621.1848Windows 11 version 22H2CVE List
  • 10.0.19045.3086Windows 10 Version 22H2CVE List
  • 10.0.14393.5989Windows 10 Version 1607CVE List
  • 10.0.14393.5989Windows Server 2016CVE List
  • 10.0.14393.5989Windows Server 2016 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 13 Jun 2023, 23:26 UTCPublishedCVE List
  2. 29 Feb 2024Added to CISA KEVCISA KEV

Description

Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Text from CVE List

Affected versions 12

  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.4499CVE List
  • Windows 10 Version 1809affected: 10.0.0 before 10.0.17763.4499CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.4499CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.4499CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.1787CVE List
  • Windows 11 version 21H2affected: 10.0.0 before 10.0.22000.2057CVE List
  • Windows 10 Version 21H2affected: 10.0.19043.0 before 10.0.19044.3086CVE List
  • Windows 11 version 22H2affected: 10.0.22621.0 before 10.0.22621.1848CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.3086CVE List
  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.5989CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.5989CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.5989CVE List

References 3