CVE-2023-29336: Microsoft Win32k use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a public exploit and high EPSS, but exploitation requires local access and low privileges, so it is a serious post-compromise escalation risk rather than a remote one.

What it is

CVE-2023-29336 is a use-after-free (CWE-416) in the Windows Win32k subsystem that allows a local attacker to elevate privileges. It affects multiple Windows 10 and Windows Server releases, and Microsoft addressed it with May 2023 updates. Because Win32k is a core kernel component, successful exploitation yields SYSTEM-level access.

Impact

An attacker who exploits this flaw gains elevated privileges on the affected host, typically SYSTEM, enabling full control of the machine. That access can be used to disable defenses, install persistence, or move laterally.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an account on the target system. It is not remotely reachable and does not require tricking a user.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-09 with a 2023-05-30 remediation due date, and a public exploit exists on Exploit-DB; EPSS is 0.409 (98.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the May 2023 Microsoft security updates for all affected Windows 10 and Windows Server versions as the primary fix.
• Prioritize patching internet-facing and high-value systems, then complete remediation by the CISA KEV due date.
• Restrict local logon and interactive access to only trusted users to reduce the pool of potential local attackers.
• Enable and monitor Windows Defender and EDR detections for privilege escalation behavior on endpoints.
• Verify patch status across the listed products, including older Windows Server 2008 and 2012 builds that may be out of support.

Detection

• Monitor for unexpected processes gaining SYSTEM or high-integrity tokens, especially from user-writable paths.
• Alert on suspicious Win32k-related crashes or use-after-free indicators in kernel telemetry.
• Hunt for known public exploit artifacts or tooling associated with CVE-2023-29336 on endpoints.
• Correlate local privilege escalation events with subsequent persistence or defense-evasion activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.