{"id":"CVE-2023-36033","kind":"vulnerability","aliases":["CVE-2023-36033"],"related":[],"title":"Windows DWM Core Library Elevation of Privilege Vulnerability","description":"Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"A flaw in the Windows Desktop Window Manager (DWM) Core Library lets a local user gain higher privileges on the machine. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-11-14T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.5122"],"affected":"< 10.0.17763.5122","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19041.3693"],"affected":"< 10.0.19041.3693","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.3693"],"affected":"< 10.0.19045.3693","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.2600"],"affected":"< 10.0.22000.2600","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.2715"],"affected":"< 10.0.22621.2715","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22621.2715"],"affected":"< 10.0.22621.2715","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.5122"],"affected":"< 10.0.17763.5122","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2113"],"affected":"< 10.0.20348.2113","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.531"],"affected":"< 10.0.25398.531","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","windows"],"not_affected_if":["unpatched-builds-not-in-use"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2023-36033 per vendor instructions; the sources do not name the KB or build.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","status":"open","published_at":"2023-11-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2023-36033 per vendor instructions; the sources do not name the KB or build.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","reach":"local","impact":"high","summary":"A flaw in the Windows Desktop Window Manager (DWM) Core Library lets a local user gain higher privileges on the machine. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local attacker gains SYSTEM-level privileges on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2023-36033 to get the patched KB numbers and affected Windows builds for how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-builds-not-in-use"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2826,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':10A,13A '-36033':11A,14A '10':19A,23A,27A '11':31A,35A,39A '1809':20A '2019':44A '2022':48A,52A '21h2':24A,32A '22h2':28A,36A '23h2':40A,53A 'action':109C 'activ':85B 'allow':103C 'appli':110C 'cisa':81B,107C 'contain':98C 'core':3A,69B,96C 'cve':9A,12A 'desktop':65B,92C 'discontinu':116C 'dwm':2A,68B,95C 'elev':5A 'escal':106C 'exploit':54B,86B 'flaw':61B 'gain':75B 'higher':76B 'host':58B 'infrastructur':55B 'instruct':114C 'let':71B 'librari':4A,70B,97C 'list':82B 'local':73B 'machin':80B 'manag':67B,94C 'microsoft':15A,17A,21A,25A,29A,33A,37A,41A,45A,49A,90C 'mitig':111C,122C 'per':112C 'privileg':7A,77B,105C 'product':120C 'requir':108C 'self':57B 'self-host':56B 'server':43A,47A,51A 'unavail':124C 'unspecifi':100C 'use':117C 'user':74B 'vendor':113C 'vulner':8A,101C 'wild':89B 'window':1A,59B,64B,66B,91C,93C 'windows':16A,18A,22A,26A,30A,34A,38A,42A,46A,50A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-11-14T00:00:00+00:00","kev":{"dateAdded":"2023-11-14","dueDate":"2023-12-05","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-36033","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033","severity":null,"published_at":"2023-11-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-36033","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36033","severity":null,"published_at":"2023-11-14T18:15:32+00:00","modified_at":"2026-06-17T06:05:42+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}