IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta KEV

CVE-2023-36033Windows DWM Core Library Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1809; Microsoft Windows Server 2019; Microsoft Windows Server 2019 (Server Core installation); Microsoft Windows Server 2022 Publicada: (hace 2 años)

Explotación conocida — Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

CISA confirmó el 14.11.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 05.12.2023.

Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36033

Descripción

Windows DWM Core Library Elevation of Privilege Vulnerability

Debilidad (CWE): CWE-822CWE-119

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
microsoft windows 10 1809 10.0.17763.0 – < 10.0.17763.5122
microsoft windows 10 21H2 10.0.19043.0 – < 10.0.19043.3693
microsoft windows 10 22H2 10.0.19045.0 – < 10.0.19045.3693
Microsoft Windows 10 Version 1809 10.0.17763.0 – < 10.0.17763.5122
Microsoft Windows 10 Version 21H2 10.0.19043.0 – < 10.0.19043.3693
Microsoft Windows 10 Version 22H2 10.0.19045.0 – < 10.0.19045.3693
microsoft windows 11 21H2 10.0.0 – < 10.0.22000.2600
microsoft windows 11 22H2 10.0.22621.0 – < 10.0.22621.2715
microsoft windows 11 23H2 10.0.22631.0 – < 10.0.22631.2715
Microsoft Windows 11 version 21H2 10.0.0 – < 10.0.22000.2600
Microsoft Windows 11 version 22H2 10.0.22621.0 – < 10.0.22621.2715
Microsoft Windows 11 version 22H3 10.0.22631.0 – < 10.0.22631.2715
Microsoft Windows 11 Version 23H2 10.0.22631.0 – < 10.0.22631.2715
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.5122
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.5122
Microsoft Windows Server 2022 10.0.20348.0 – < 10.0.20348.2113
microsoft windows server 2022 23h2 < 10.0.25398.531
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 – < 10.0.25398.531
microsoft windows server 23h2 10.0.25398.0 – < 10.0.25398.531

Referencias y parches

Coincidencias CPE (NVD) (18)
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:* < 10.0.17763.5122
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* < 10.0.17763.5122
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* < 10.0.17763.5122
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* < 10.0.19041.3693
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* < 10.0.19041.3693
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* < 10.0.19041.3693
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* < 10.0.19045.3693
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* < 10.0.19045.3693
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* < 10.0.19045.3693
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:* < 10.0.22000.2600
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:* < 10.0.22000.2600
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:* < 10.0.22621.2715
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:* < 10.0.22621.2715
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* < 10.0.22621.2715
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* < 10.0.22621.2715
  • cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.5122
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.2113
  • cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* < 10.0.25398.531

CVE recientes del mismo producto — Windows 10

7.0Alta
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Media
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS