CVE-2023-21823: Windows Graphics Component integer overflow allows local code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA's KEV catalog with confirmed in-the-wild exploitation and high CVSS impact, though it requires local low-privileged access rather than remote reach.

What it is

CVE-2023-21823 is an integer overflow (CWE-190) in the Microsoft Windows Graphics Component that can lead to remote code execution. It affects a broad set of Windows 10, Windows 11 and Windows Server releases. The record gives only a one-line description, so the exact vulnerable function and trigger are not specified.

Impact

An attacker who can run code on a target system can exploit the flaw to execute code at a higher integrity level, gaining the privileges of the exploited process. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The CVSS vector is AV:L/AC:L/PR:L/UI:N, so the flaw is reached locally by an attacker who already holds low privileges on the machine; no user interaction is required. It is not remotely reachable over the network in this scoring.

Exploitation

CVE-2023-21823 is listed in CISA's Known Exploited Vulnerabilities catalog with a due date of 2023-03-07, indicating exploitation in the wild. EPSS gives a 30-day probability of 0.05563 (92.5th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2023-21823 to all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• Prioritize patching systems where untrusted users already have local access, such as multi-user endpoints and terminal servers.
• Restrict local logon and interactive access to only users who need it, to reduce the pool of accounts that can reach the flaw.
• Track CISA KEV remediation deadlines and confirm patching through inventory or vulnerability scanning.

Detection

• Monitor for unexpected child processes spawned by graphics-related Windows processes, which can indicate privilege escalation activity.
• Alert on local privilege escalation attempts and suspicious token or integrity-level changes in endpoint telemetry.
• Hunt for known exploitation artifacts tied to this CVE in host logs and correlate with the KEV listing.
• Verify patch state of the affected Windows builds through asset inventory rather than relying on endpoint alerts alone.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.