CVE-2023-29360

What it actually does

CVE-2023-29360 is a local elevation-of-privilege vulnerability in Microsoft Windows Streaming Service, associated with unsafe handling of trusted versus untrusted pointers. An attacker who can run code on an affected Windows host can exploit the flaw to execute code with elevated privileges, potentially reaching SYSTEM-level control. The vulnerability affects multiple supported Windows desktop and server releases, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022. The CVSS vector indicates local attack access, low attack complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can turn an initial foothold on a Windows workstation or server into full local control, allowing attackers to disable defenses, dump credentials, install persistence, tamper with data, and move laterally. Because this vulnerability is listed in CISA KEV and has been observed exploited in the wild, organizations should treat unpatched affected Windows systems as high-priority exposure, especially internet-facing systems, administrator workstations, domain-connected endpoints, and servers that process untrusted content. CISA’s KEV remediation deadline was 2024-03-21, so systems still missing the relevant Microsoft security updates are materially overdue.

How an attack unfolds

An attacker first needs the ability to execute code locally on an affected Windows system, which may come from phishing, malware execution, exploitation of another application, abuse of exposed remote access, or a compromised low-privilege account. The attacker then triggers the Microsoft Streaming Service vulnerability by interacting with the vulnerable Windows component in a way that causes unsafe pointer handling. If successful, the exploit elevates the attacker’s execution context to a highly privileged local context, commonly enabling SYSTEM-level actions. From there, the attacker can disable endpoint security tools, access protected files and credentials, create or modify local accounts, install services or scheduled tasks for persistence, and use the compromised system as a staging point for lateral movement. Public reporting and KEV inclusion indicate active exploitation in the wild; detection should therefore focus both on patch status and on post-exploitation behaviors that commonly follow local privilege escalation.

How to fix it

Apply the Microsoft security updates that address CVE-2023-29360 for all affected Windows versions. Prioritize Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 21H2 and 22H2; Windows Server 2016; Windows Server 2019; and Windows Server 2022. Because no product-specific fixed version list was provided, remediation should be validated against the relevant Microsoft June 2023 or later cumulative security update level for each operating system build. Where immediate patching is not possible, reduce exposure by restricting local code execution, removing unnecessary interactive access, enforcing application control, limiting local administrator rights, enabling tamper protection, and monitoring aggressively for privilege-escalation and post-exploitation activity. Compensating controls should not be treated as a substitute for installing the vendor security update.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative security update that includes the fix for CVE-2023-29360. Validate using centralized patch management, Microsoft Defender Vulnerability Management, Windows Update for Business, WSUS, SCCM/MECM, or equivalent inventory tools. On individual systems, review installed hotfixes and OS build numbers with commands such as `Get-HotFix`, `wmic qfe list`, or `winver`, then compare the result against Microsoft’s official security update guidance for the relevant Windows release. Confirm that vulnerability scanners no longer report the host as affected. For high-risk systems, also verify that endpoint protection remains enabled, no unexpected privileged services or scheduled tasks were created, and no suspicious local privilege escalation activity occurred before patching.

Typical attack path

1. Gain initial code execution on an affected Windows workstation or server through malware, phishing, stolen credentials, exposed remote access, or another vulnerability.
2. Run a local exploit targeting the Microsoft Windows Streaming Service vulnerability.
3. Escalate from the initial execution context to a highly privileged local context such as SYSTEM.
4. Disable or tamper with endpoint protection, logging, or recovery controls.
5. Dump credentials, access protected data, or create privileged persistence mechanisms.
6. Use the elevated host as a platform for lateral movement, data theft, additional malware deployment, or operational disruption.

How to detect it

There are no universally reliable, vulnerability-specific indicators that prove exploitation of this Windows local privilege-escalation flaw. Detection should combine patch-status review with endpoint and Windows event telemetry for suspicious activity that occurs immediately before or after a process gains elevated privileges. Useful log sources include EDR process telemetry, Windows Security logs, Sysmon, Microsoft Defender for Endpoint advanced hunting, PowerShell logs, service-control events, scheduled task events, driver-load events, crash dumps, and authentication logs. Hunt for unusual non-administrative processes spawning SYSTEM-level child processes, unexpected service creation, suspicious scheduled tasks, credential dumping tools, LSASS access, Defender or EDR tampering, anomalous driver loads, and lateral movement after local execution. Relevant Windows events to review include Security 4688 for process creation, 4672 for special privileges assigned, 7045 for new service installation from the System log, 4697 for service installation where enabled, 4698 for scheduled task creation, 1102 for audit log clearing, 7031/7034 for service crashes, and Defender operational events showing protection changes. Because this CVE is KEV-listed and actively exploited, absence of a single IOC should not be interpreted as absence of compromise.

• CVE-2023-29360
• mskssrv.sys
• Microsoft Streaming Service
• Microsoft-Windows-Kernel-Streaming
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 4672
• Event ID 4688
• Event ID 1102
• Event ID 7031
• Event ID 7034
• sc.exe create
• schtasks.exe /create
• wevtutil.exe cl
• powershell.exe Set-MpPreference
• MpCmdRun.exe
• lsass.exe

What your security team should do

• Treat this as an urgent patching item because it is in CISA KEV and exploitation has been observed in the wild.
• Identify all affected Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 systems and confirm they are on a fixed Microsoft cumulative update level.
• Prioritize remediation for servers, domain-joined endpoints, administrator workstations, systems with sensitive data, and devices used by privileged users.
• Hunt for signs of prior compromise, focusing on local privilege escalation followed by SYSTEM-level process execution, security tool tampering, suspicious service creation, credential dumping, and lateral movement.
• Review endpoint telemetry around the date of any suspected compromise or before the patch installation date, since exploitation may leave limited vulnerability-specific artifacts.
• Enforce least privilege and application control to reduce the likelihood that an attacker can run a local exploit after initial access.
• Ensure EDR, Microsoft Defender, Windows event logging, PowerShell logging, and process creation logging are enabled and retained long enough to support retrospective investigation.
• If exploitation is suspected, isolate affected hosts, preserve forensic evidence, rotate credentials exposed on those systems, and investigate lateral movement before returning systems to production.