Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2023-36025 1 CVE

Windows SmartScreen Security Feature Bypass Vulnerability

Published Nov 14, 2023 · Updated Nov 22, 2023 · Revision 2

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Exploited according to Microsoft, publicly disclosed before the fix — Exploitation Detected. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The attacker would be able to bypass Windows Defender SmartScreen checks and their associated prompts.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted Internet Shortcut (.URL) or a hyperlink pointing to an Internet Shortcut file to be compromised by the attacker.

Security updates
10.0.17763.5122 — https://support.microsoft.com/help/5032196
10.0.20348.2113 — https://support.microsoft.com/help/5032198
10.0.20348.2091 — https://support.microsoft.com/help/5032304
10.0.22000.2600 — https://support.microsoft.com/help/5032192
10.0.19043.3693 — https://support.microsoft.com/help/5032189
10.0.22621.2715 — https://support.microsoft.com/help/5032190
10.0.25398.531 — https://support.microsoft.com/help/5032202
10.0.10240.20308 — https://support.microsoft.com/help/5032199
10.0.14393.6452 — https://support.microsoft.com/help/5032197
6.0.6003.22367 — https://support.microsoft.com/help/5032254
6.0.6003.22367 — https://support.microsoft.com/help/5032248
6.1.7601.26816 — https://support.microsoft.com/help/5032252
6.1.7601.26816 — https://support.microsoft.com/help/5032250
6.2.9200.24569 — https://support.microsoft.com/help/5032247
6.3.9600.21668 — https://support.microsoft.com/help/5032249

Vulnerabilities 1

Revision history

  1. #2

    For informational accuracy, updated the Publicly Disclosed information.

  2. #1

    Information published.

References