CVE-2023-36802: Microsoft Streaming Service Proxy use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a locally exploitable use-after-free with high confidentiality, integrity and availability impact, and CISA KEV listing confirms active exploitation, though it requires existing local access rather than being remotely reachable.

What it is

CVE-2023-36802 is a use-after-free (CWE-416) in the Microsoft Streaming Service Proxy that allows a local attacker to elevate privileges on affected Windows systems. It affects Windows 10, Windows 11, Windows Server 2019 and Windows Server 2022, and Microsoft has released a patch. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it is being used in real attacks and warrants prompt remediation.

Impact

A successful attacker gains full control of the affected host, with high impact to confidentiality, integrity and availability, typically escalating from a low-privileged local account to SYSTEM. This enables credential theft, disabling of security controls and further lateral movement.

Attack surface

The vector is local (AV:L) with low attack complexity, low privileges required and no user interaction, so the attacker must already have code execution or an account on the target machine. It is not remotely reachable over the network without prior access.

Exploitation

CISA added this CVE to the KEV catalog on 2023-09-12 with a remediation due date of 2023-10-03, confirming active exploitation in the wild. EPSS gives a 30-day exploitation probability of roughly 0.28 (98th percentile), and no ransomware campaign use is documented in this record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-36802 as soon as possible, prioritizing internet-facing and high-value systems.
• If patching cannot be completed by the KEV due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Restrict and monitor local interactive logon and code execution paths so a low-privileged user cannot reach the vulnerable Streaming Service Proxy component.
• Track patch compliance for all listed Windows 10, Windows 11, Windows Server 2019 and Windows Server 2022 builds and report unpatched hosts.
• Review endpoint detection coverage for local privilege escalation behavior and ensure alerts are triaged.

Detection

• Monitor for unexpected processes spawning with SYSTEM integrity from low-privileged parent processes, especially those interacting with streaming or media service components.
• Hunt for use-after-free exploitation indicators such as crashes or abnormal terminations in the Streaming Service Proxy process and related Windows event logs.
• Correlate local privilege escalation alerts with subsequent credential access, service creation or security tool tampering on the same host.
• Audit hosts for missing patches matching the affected Windows builds and flag any that remain unpatched past the KEV due date.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.