CVE-2023-36884: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Search Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Windows Search can be tricked into running malicious code when processing specially crafted files, allowing an attacker to take control of your computer without needing special permissions.
A race condition in Windows Search (CWE-362) allows remote code execution when processing maliciously crafted documents. An attacker can exploit this by delivering a specially formatted file that triggers the vulnerability during indexing, bypassing user privilege requirements and achieving code execution in the Search service context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.