CVE-2023-21674: Windows ALPC use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and has a high EPSS score, but it requires a local foothold and a patch is available.

What it is

CVE-2023-21674 is a use-after-free (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) subsystem that allows elevation of privilege. It affects a broad set of Windows client and server releases, and Microsoft published a patch on 2023-01-10. Because ALPC is a core inter-process communication mechanism, a local attacker with limited rights can turn this into full system compromise.

Impact

An attacker who exploits the flaw gains elevated privileges, with the CVSS vector indicating high confidentiality, integrity and availability impact and a changed scope, meaning control can extend beyond the vulnerable component. In practice this yields SYSTEM-level access on the host.

Attack surface

The vector is local (AV:L) with low attack complexity, low privileges required and no user interaction, so the attacker must already have code execution or a foothold on the machine. No remote or network path is described in the record.

Exploitation

CVE-2023-21674 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-01-10, remediation due 2023-01-31), confirming exploitation in the wild. EPSS gives a 30-day probability of 0.41806 (98.6th percentile), indicating high predicted activity; the record does not state whether it was used in ransomware campaigns.

What to do

• Apply the Microsoft security update for CVE-2023-21674 to all affected Windows client and server versions as the first action.
• Prioritize internet-facing and high-value hosts, and any system where an attacker could already run code, since exploitation requires a local foothold.
• Restrict local logon and code execution rights to reduce the number of users who can reach the vulnerable ALPC interface.
• Track CISA KEV remediation deadlines and verify patching through inventory or vulnerability scanning.

Detection

• Monitor for unexpected processes gaining SYSTEM or elevated tokens, especially children of low-privilege processes.
• Alert on suspicious ALPC activity and named-pipe or LPC endpoint access from unusual or non-service processes.
• Correlate local privilege-escalation behavior with post-exploitation activity such as credential dumping or service creation.
• Use EDR telemetry to flag known exploit patterns against ALPC and review hosts that remain unpatched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.