What is the fix for CVE-2023-36033?

Apply the Microsoft security update for CVE-2023-36033 per vendor instructions; the sources do not name the KB or build. If no mitigation is available, CISA says to discontinue use of the affected product.

Who is not affected by CVE-2023-36033?

Not affected if: unpatched-builds-not-in-use.

Live › vulnerability › CVE-2023-36033

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows DWM Core Library Elevation of Privilege Vulnerability

A flaw in the Windows Desktop Window Manager (DWM) Core Library lets a local user gain higher privileges on the machine. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Nov 14, 2023 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 14, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local attacker gains SYSTEM-level privileges on the Windows machine.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2023-36033

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows DWM Core Library Elevation of Privilege Vulnerability

A flaw in the Windows Desktop Window Manager (DWM) Core Library lets a local user gain higher privileges on the machine. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Nov 14, 2023 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 14, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local attacker gains SYSTEM-level privileges on the Windows machine.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Microsoft Windows	vendor	–	–
microsoft windows 10 1809	vendor	< 10.0.17763.5122	10.0.17763.5122
microsoft windows 10 21h2	vendor	< 10.0.19041.3693	10.0.19041.3693
microsoft windows 10 22h2	vendor	< 10.0.19045.3693	10.0.19045.3693
microsoft windows 11 21h2	vendor	< 10.0.22000.2600	10.0.22000.2600
microsoft windows 11 22h2	vendor	< 10.0.22621.2715	10.0.22621.2715
microsoft windows 11 23h2	vendor	< 10.0.22621.2715	10.0.22621.2715
microsoft windows server 2019	vendor	< 10.0.17763.5122	10.0.17763.5122
microsoft windows server 2022	vendor	< 10.0.20348.2113	10.0.20348.2113
microsoft windows server 2022 23h2	vendor	< 10.0.25398.531	10.0.25398.531

Windows DWM Core Library Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Windows DWM Core Library Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources