Feb 2023: Windows Graphics Component Remote Code Execution Vulnerability
CVE-2023-21823 Published on February 14, 2023

Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability

Vendor Advisory NVD

Known Exploited Vulnerability

This Microsoft Windows Graphic Component Privilege Escalation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft Windows Graphic Component contains an unspecified vulnerability which allows for privilege escalation.

The following remediation steps are recommended / required by March 7, 2023: Apply updates per vendor instructions.

Weakness Type

Integer Overflow or Wraparound

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. An integer overflow or wraparound occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may wrap to become a very small or negative number. While this may be intended behavior in circumstances that rely on wrapping, it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs. This becomes security-critical when the result is used to control looping, make a security decision, or determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.


Products Associated with CVE-2023-21823

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Windows Server 2008
 
Microsoft Windows Server 2012
 
Microsoft Windows Server 2016
 
Microsoft Windows Server 2019
 
Microsoft Windows Server 2022
 
Microsoft Windows 10
 
Microsoft Windows 10 1507
 
Microsoft Windows 11
 
Microsoft Office
 
Microsoft Windows Server 2008 Sp2
 
Microsoft Windows Server 2008 R2
 
Microsoft Windows Server 2012 R2
 

Affected Versions

Microsoft Office for Android: Microsoft Office for Universal: Microsoft Office for iOS: Microsoft Windows 10 Version 1809: Microsoft Windows 10 Version 1809: Microsoft Windows Server 2019: Microsoft Windows Server 2019 (Server Core installation): Microsoft Windows Server 2022: Microsoft Windows 10 Version 20H2: Microsoft Windows 11 version 21H2: Microsoft Windows 10 Version 21H2: Microsoft Windows 11 version 22H2: Microsoft Windows 10 Version 22H2: Microsoft Windows 10 Version 1507: Microsoft Windows 10 Version 1607: Microsoft Windows Server 2016: Microsoft Windows Server 2016 (Server Core installation): Microsoft Windows Server 2008 Service Pack 2: Microsoft Windows Server 2008 Service Pack 2 (Server Core installation): Microsoft Windows Server 2008 Service Pack 2: Microsoft Windows Server 2008 R2 Service Pack 1: Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation): Microsoft Windows Server 2012: Microsoft Windows Server 2012 (Server Core installation): Microsoft Windows Server 2012 R2: Microsoft Windows Server 2012 R2 (Server Core installation):

Exploit Probability

EPSS
4.17%
Percentile
88.54%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.