{"id":"CVE-2023-21768","published":"2023-01-10T00:00:00Z","modified":"2025-01-01T00:36:09Z","title":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","vendor":"Microsoft","product":"Windows Server 2022","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Windows Server 2022","versions":[">= 10.0.20348.0, < 10.0.20348.1487"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[">= 10.0.0, < 10.0.22000.1455"]},{"vendor":"Microsoft","product":"Windows 11 version 22H2","versions":[">= 10.0.22621.0, < 10.0.22621.1105"]}],"description":{"text":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","provenance":"source","from":"CVE.org"},"summary":{"text":"The Windows Ancillary Function Driver for WinSock in Microsoft Windows Server 2022 contains an elevation of privilege flaw involving untrusted pointer dereference. A local attacker with low-privileged credentials and no required user interaction could exploit it to gain elevated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:29Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.65417,"percentile":0.99256,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-03-14","exploitedFirstSeen":"2023-03-14","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-03-14"},{"url":"https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/","date":"2023-03-21"},{"url":"https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf","date":"2024-02-02"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"UPX executable packer.","url":"https://otx.alienvault.com/pulse/663d2869e0f3a42bbddc42ff","created":"2024-05-09"},{"name":"ACTUALIZACION | Microsoft Security Response Center (MSRC) ENERO 2023","url":"https://otx.alienvault.com/pulse/63c1ccda5d013cb9ebe876d7","created":"2023-01-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-822","name":"Untrusted Pointer Dereference"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21768","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-25935","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25935","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":12,"skipped":2,"earliest":"2023-03-07","earliestUrl":"https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768","repos":[{"name":"chompie1337/Windows_LPE_AFD_CVE-2023-21768","url":"https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768","stars":506,"created":"2023-03-07"},{"name":"SamuelTulach/nullmap","url":"https://github.com/SamuelTulach/nullmap","stars":203,"created":"2023-03-10"},{"name":"Malwareman007/CVE-2023-21768","url":"https://github.com/Malwareman007/CVE-2023-21768","stars":68,"created":"2023-03-13"},{"name":"cl4ym0re/cve-2023-21768-compiled","url":"https://github.com/cl4ym0re/cve-2023-21768-compiled","stars":27,"created":"2023-03-10"},{"name":"P4x1s/CVE-2023-21768-POC","url":"https://github.com/P4x1s/CVE-2023-21768-POC","stars":23,"created":"2023-03-22"}]},"metasploit":[{"name":"Ancillary Function Driver (AFD) for WinSock Elevation of Privilege","module":"exploit/windows/local/cve_2023_21768_afd_lpe","type":"exploit","disclosureDate":"2023-01-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb"}],"first":{"date":"2023-01-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-01-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-21768","provenance":"source"},{"date":"2023-01-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-03-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb","provenance":"source"},{"date":"2023-03-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1325 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9926"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"12 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-822"}}