In CISA KEV7.8 HighCWE-125
CVE-2023-36424
Microsoft Windows Out-of-Bounds Read Vulnerability
MicrosoftWindows
Status
- Exploited in the wild
- In CISA KEV since 13 Apr
- Vendor fix available
Federal deadlineMon 27 Apr, 23:59 UTC
Passed 180 days ago
CISA KEV · added 13 Apr
Exploit probabilityEPSSchecked 18 Oct
12%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
SeverityCVSS
7.8High
Description NVD
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 5 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 13 Apr · 21:27 UTC | CISA | CISA Adds CVE-2023-36424 to Known Exploited Vulnerabilities Catalogue |
| Mon 13 Apr · 22:05 UTC | CISA | CISA Adds Windows Privilege Flaw CVE-2023-36424 to KEV Catalog |
| Tue 14 Apr · 06:31 UTC | The Hacker News | CISA adds six KEV flaws amid active Fortinet exploits |
| Tue 14 Apr · 08:11 UTC | Security Affairs | CISA Adds Critical Adobe, Microsoft, Fortinet Flaws to KEV Catalog |
| Tue 14 Apr · 09:17 UTC | SecurityWeek | Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities |
- Organizations Warned of Exploited Windows, Adobe Acrobat VulnerabilitiesSecurityWeek
- CISA Adds Critical Adobe, Microsoft, Fortinet Flaws to KEV CatalogSecurity Affairs · mentions it in passing
- CISA adds six KEV flaws amid active Fortinet exploitsThe Hacker News · mentions it in passing
- CISA Adds Windows Privilege Flaw CVE-2023-36424 to KEV CatalogCISA · official notice
- CISA Adds CVE-2023-36424 to Known Exploited Vulnerabilities CatalogueCISA · first in our coverage · official notice