CVE-2023-29360: Microsoft Streaming Service elevation of privilege via untrusted pointer dereference

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA's KEV catalog with a high EPSS score and a CVSS of 8.4, though exploitation requires a local foothold rather than remote access.

What it is

CVE-2023-29360 is an elevation of privilege flaw in the Microsoft Streaming Service on multiple Windows client and server versions, caused by an untrusted pointer dereference (CWE-822). A local attacker who can run code on a target can exploit it to gain higher privileges, which matters because it gives a foothold for full system compromise. The record gives no further technical detail on the vulnerable component or trigger.

Impact

A local attacker gains elevated privileges on the affected host, potentially reaching SYSTEM-level access. That access can be used to disable defenses, persist, or move laterally.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) and no user interaction (UI:N), so the attacker must already have code execution or a local session on the machine. It is not reachable remotely over the network.

Exploitation

It is listed in CISA's Known Exploited Vulnerabilities catalog (added 2024-02-29), indicating exploitation in the wild, and EPSS gives a 30-day probability of about 22 percent (97.5th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2023-29360 on all affected Windows 10, Windows 11, Windows Server 2016, 2019 and 2022 systems.
• Prioritize patching internet-facing and high-value hosts, and track remediation against the CISA KEV due date of 2024-03-21.
• Restrict local interactive and code-execution access to trusted users, since exploitation requires a local foothold.
• If patching cannot be completed, follow vendor mitigations or discontinue use of the affected product as CISA directs.

Detection

• Monitor for unexpected privilege changes or new SYSTEM-level processes spawned from non-privileged user contexts.
• Alert on unusual access or crashes involving the Windows Streaming Service and its related processes.
• Review endpoint telemetry for local privilege escalation tooling or exploit artifacts on affected Windows builds.
• Correlate local logon and process-creation events around known exploitation windows on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.