CVE-2023-36563: Microsoft WordPad improper input validation information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS is only Medium, but confirmed exploitation via CISA KEV and a high EPSS percentile raise the operational risk.

What it is

WordPad on multiple Windows client and server versions fails to properly validate input, allowing an information disclosure. The flaw is rated CVSS 3.1 5.5 (Medium) and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being used in the wild despite the moderate score.

Impact

An attacker can read sensitive data that the vulnerable process has access to, resulting in confidentiality loss. There is no integrity or availability impact per the CVSS vector.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attacker must get a user to open or interact with a crafted file or content on the target machine. No authentication is needed beyond local access and the victim's action.

Exploitation

CISA added it to KEV on 2023-10-10 with a remediation due date of 2023-10-31, confirming known exploitation; EPSS 30-day probability is about 20.7 percent (97th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows versions.
• If patching cannot be completed immediately, follow CISA's required action and vendor mitigations, or discontinue use of WordPad where feasible.
• Restrict execution of untrusted documents and block WordPad file types from untrusted sources via email and web gateways.
• Enforce least privilege so a local attacker cannot reach sensitive data through the WordPad process.
• Track KEV remediation deadlines and verify patching across all listed Windows 10, Windows 11 and Windows Server builds.

Detection

• Monitor for WordPad (write.exe/wordpad.exe) spawning unusual child processes or making unexpected network connections.
• Alert on WordPad opening files from email attachments, downloads or removable media in sensitive environments.
• Review endpoint logs for anomalous file reads by WordPad processes touching credential or configuration stores.
• Correlate KEV status with asset inventory to confirm affected hosts are patched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.