CVE-2023-36033: Windows DWM Core Library elevation of privilege via memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a locally exploitable elevation of privilege flaw with a CVSS of 7.8 and confirmed inclusion in CISA KEV, though it requires an existing local foothold rather than remote access.

What it is

CVE-2023-36033 is an elevation of privilege flaw in the Windows Desktop Window Manager (DWM) Core Library, classified as a memory buffer overflow (CWE-119/CWE-822). A local attacker with low privileges can exploit it to gain higher privileges on the host, which matters because it is listed in CISA's Known Exploited Vulnerabilities catalog. The record does not describe the specific vulnerable code path or affected build versions beyond the product list.

Impact

An attacker who successfully exploits the flaw gains elevated privileges on the Windows host, with high impact to confidentiality, integrity and availability per the CVSS vector. In practice this allows a low-privileged local user to escape their privilege boundary and take control of the system.

Attack surface

The CVSS vector is local (AV:L), low complexity, low privileges required, and no user interaction (PR:L/UI:N), so the flaw is reached by running code on the target machine rather than over the network. No authentication beyond an existing low-privileged local session is needed.

Exploitation

CVE-2023-36033 was added to CISA KEV on 2023-11-14 with a remediation due date of 2023-12-05, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.11977 (95.9th percentile), and the record does not document ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2023-36033 as listed in the MSRC update guide, prioritizing affected Windows 10, Windows 11 and Windows Server builds.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if no mitigation is available, within the 2023-12-05 due date.
• Restrict and monitor local interactive access and privilege escalation paths on endpoints, since exploitation requires a local low-privileged foothold.
• Track patch compliance for the listed Windows 10, Windows 11 and Windows Server 2019/2022 products and verify DWM-related updates are installed.

Detection

• Monitor for unexpected privilege escalation or token manipulation events tied to DWM processes on endpoints.
• Hunt for suspicious local processes spawning from or interacting with dwm.exe outside normal desktop composition behavior.
• Correlate endpoint telemetry for memory corruption indicators in DWM with subsequent high-integrity process creation.
• Review host logs for anomalous local user activity on unpatched Windows builds matching the affected product list.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.