CVE-2023-36563: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Microsoft WordPad Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft WordPad can accidentally reveal sensitive information from your computer's memory when you open certain files. This happens because the application doesn't properly check the data it reads, allowing attackers to see private information they shouldn't access.
CWE-20 (Improper Input Validation) in Microsoft WordPad allows information disclosure through insufficient validation of file contents. An attacker can craft a malicious document that, when opened by a user, causes the application to expose sensitive data from process memory. The attack requires user interaction (opening a file) and results in unauthorized information exposure.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.