Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2023-36884 1 CVE

Windows Search Remote Code Execution Vulnerability

Published Jul 11, 2023 · Updated Oct 17, 2023 · Revision 5

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

According to the CVSS metric, successful exploitation of this vulnerability could lead to high loss of confidentiality (C:H), integrity (I:H) and availability (A:H). What does that mean for this vulnerability?
An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system.

How could an attacker exploit the vulnerability?
In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the remote code execution vulnerability.
In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment.

Security updates
10.0.17763.4737 — https://support.microsoft.com/help/5029247
10.0.20348.1906 — https://support.microsoft.com/help/5029250
10.0.20348.1903 — https://support.microsoft.com/help/5029367
10.0.22000.2295 — https://support.microsoft.com/help/5029253
10.0.19044.3324 — https://support.microsoft.com/help/5029244
10.0.22621.2134 — https://support.microsoft.com/help/5029263
10.0.10240.20107 — https://support.microsoft.com/help/5029259
10.0.14393.6167 — https://support.microsoft.com/help/5029242
6.0.6003.22216 — https://support.microsoft.com/help/5029318
6.0.6003.22216 — https://support.microsoft.com/help/5029301
6.1.7601.26664 — https://support.microsoft.com/help/5029296
6.1.7601.26664 — https://support.microsoft.com/help/5029307
6.2.9200.24414 — https://support.microsoft.com/help/5029295
6.2.9200.24414 — https://support.microsoft.com/help/5029308
6.3.9600.21503 — https://support.microsoft.com/help/5029312
6.3.9600.21503 — https://support.microsoft.com/help/5029304

Vulnerabilities 1

Revision history

  1. #5

    Added an FAQ. This is an information change only.

  2. #4

    Links on Security Updates table corrected to reflect that the updates that address this vulnerability are the August 2023 Windows updates. Microsoft recommends installing the August 2023 updates as soon as possible.

  3. #3

    Updated affected software to include just Windows products with links to August 2023 security updates. Adjusted information in the FAQs. The Office updates are documented in [ADV230003](https://msrc.microsoft.com/update-guide/vulnerability/ADV230003).

  4. #2

    Updated FAQ information. This is an informational change only.

  5. #1

    Information published.

References