{"id":"CVE-2023-21823","published":"2023-02-14T21:15:12Z","modified":"2026-08-19T17:18:20Z","title":"Microsoft Windows Graphic Component Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Graphics Component Remote Code Execution Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A privilege escalation flaw in the Windows Graphics Component, which is part of Microsoft Windows, stems from an integer overflow or wraparound condition. An attacker who already has local access and low-privilege credentials can exploit it without any user interaction to gain elevated control of the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:42Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.05563,"percentile":0.92859,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2023-02-14","dueDate":"2023-03-07","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823;  https://nvd.nist.gov/vuln/detail/CVE-2023-21823","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-02-14","exploitedFirstSeen":"2023-02-14","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-02-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-02-14"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Feb","date":"2023-02-17"},{"url":"https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf","date":"2024-02-02"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21823","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local user opens malicious file to trigger","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows Graphics Component Remote Code Execution Vulnerability","start":0,"end":62}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploitation yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Windows Graphics Component Remote Code Execution Vulnerability","start":0,"end":62}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-25989","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25989","exploited":true,"exploitedSince":"2023-02-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-04-20","earliestUrl":"https://github.com/Elizarfish/CVE-2023-21823","repos":[{"name":"Elizarfish/CVE-2023-21823","url":"https://github.com/Elizarfish/CVE-2023-21823","stars":14,"created":"2023-04-20"}]},"first":{"date":"2023-04-20","source":"PoC-in-GitHub","url":"https://github.com/Elizarfish/CVE-2023-21823"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-02-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21823","provenance":"source"},{"date":"2023-02-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2023-02-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-02-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-25989","provenance":"source"},{"date":"2023-04-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Elizarfish/CVE-2023-21823","provenance":"source"}],"speed":{"daysToPublicExploit":65,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":64.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1356 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.57,"detail":"percentile 0.9286"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-190"}}