cbcvebase.
CVE-2023-21823
published 2023-02-14

CVE-2023-21823: Windows Graphics Component Remote Code Execution Vulnerability

PriorityP181high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2023-03-07
Exploited in the wild
EPSS
5.56%
92.0th percentile
Windows Graphics Component Remote Code Execution Vulnerability

Affected

45 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftmicrosoft_office_for_android>= 16.0.1 < 16.0.16130.2015616.0.16130.20156
microsoftmicrosoft_office_for_ios>= 2.0.0 < 2.70.230210032.70.23021003
microsoftmicrosoft_office_for_universal>= 16.0.1 < 16.0.14326.2133016.0.14326.21330
microsoftwindows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoftwindows_10_1607< 10.0.14393.571710.0.14393.5717
microsoftwindows_10_1809< 10.0.17763.401010.0.17763.4010
microsoftwindows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoftwindows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoftwindows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.1974710.0.10240.19747
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.571710.0.14393.5717
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.401010.0.17763.4010
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.401010.0.17763.4010
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.260410.0.19042.2604
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.260410.0.19044.2604
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.260410.0.19045.2604
microsoftwindows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoftwindows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22621.157410.0.22621.1574
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.126510.0.22621.1265
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.263666.1.7601.26366
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.219156.0.6003.21915
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.241166.2.9200.24116

Detection & IOCsextracted from sources · hover to see the quote

  • Talos released Snort rules to detect exploitation attempts of CVE-2023-21823; Cisco Secure Firewall customers should update their SRU, and open-source Snort Subscriber Rule Set customers can download the latest rule pack from Snort.org
  • CVE-2023-21823 is confirmed exploited in the wild (Exploited:Yes, Exploitation Detected in latest software release) — prioritize detection on Windows Graphics Component activity
  • The attack vector is local (AV:L); exploitation requires local code execution by attacker or victim — monitor for suspicious local process execution targeting the Windows Graphics Component
  • Successful exploitation grants System-level privileges — alert on unexpected SYSTEM-level process spawning from graphics-related components
  • ·Despite the CVE title saying 'Remote Code Execution', the attack vector is local (AV:L); 'Remote' refers to the attacker's logical position, not network delivery — tune detection rules accordingly to avoid false assumptions about network-based exploitation

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.