CVE-2023-36884KEV · OVERDUECWE-362

Microsoft Windows Search Remote Code Execution Vulnerability

High · published July 11, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1152
days past CISA
deadline
CVSS v3.1
7.5
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

🔥 A simple search query might lead to your worst nightmare! The Windows Search Remote Code Execution vulnerability lets attackers run malicious code just by popping into your files. ⚡ Think of it like a delivery service that opens your front door to anyone who simply asks for a package — no identification required! Your valuable data is just waiting there for the taking if you're not careful. If exploited, an attacker could gain control over your system, potentially stealing sensitive data, installing malware, or even rendering your system unusable. This is absolutely devastating for both personal and organizational security!

Put simply

Think of it like a delivery service that opens your front door to anyone who simply asks for a package — no identification required! Your valuable data is just waiting there for the taking if you're not careful. This vulnerability in Windows Search allows remote attackers to execute arbitrary code when a user performs a crafted search. It takes advantage of how search queries are processed, completely bypassing normal security checks.

What to do

If exploited, an attacker could gain control over your system, potentially stealing sensitive data, installing malware, or even rendering your system unusable. This is absolutely devastating for both personal and organizational security! To protect yourself, immediately apply the latest security updates from Microsoft, as these patches address this vulnerability directly. Additionally, review your security settings and educate users on safe search practices to avoid risky queries. You've got this! By taking these steps, you can lock down your system and keep those cyber villains at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.98932 · 99.9th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2023-07-11T23:15Z
KEV added
2023-07-17 · due 2023-08-29
Affected products (17)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2010710.0.10240.20107
microsoft/windows_10_1607< 10.0.14393.616710.0.14393.6167
microsoft/windows_10_1607< 10.0.14393.616710.0.14393.6167
microsoft/windows_10_1809< 10.0.17763.473710.0.17763.4737
microsoft/windows_10_1809< 10.0.17763.473710.0.17763.4737
microsoft/windows_10_1809< 10.0.17763.473710.0.17763.4737
microsoft/windows_10_21h2< 10.0.19044.332410.0.19044.3324
microsoft/windows_10_22h2< 10.0.19044.332410.0.19044.3324
microsoft/windows_11_21h2< 10.0.22000.229510.0.22000.2295
microsoft/windows_11_22h2< 10.0.22621.213410.0.22621.2134
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.616710.0.14393.6167
microsoft/windows_server_2019< 10.0.17763.473710.0.17763.4737
microsoft/windows_server_2022< 10.0.20348.190310.0.20348.1903
References (4)
EPSS history
Timeline
  • 17 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 29
    kev
  • 11 JUL 18:14Z
    Windows Search Remote Code Execution Vulnerability
    cvelistv5