CVE-2023-36033

What it actually does

This is a local elevation-of-privilege vulnerability in the Windows Desktop Window Manager Core Library associated with memory corruption. An attacker who already has low-privileged local code execution can trigger the flaw without user interaction and potentially execute code with elevated privileges, compromising confidentiality, integrity, and availability on the affected system. Because the vulnerability is listed in CISA KEV and has active in-the-wild exploitation, it should be treated as operationally proven rather than theoretical.

Why it matters to the business

Successful exploitation can turn an initial low-privilege foothold into full control of a Windows endpoint or server, enabling credential theft, security tool tampering, lateral movement, persistence, and deployment of additional malware. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog with a remediation due date of 2023-12-05, so organizations subject to that guidance should already have remediated it and should prioritize verification and retrospective threat hunting.

How an attack unfolds

An attacker first obtains the ability to run code locally on an affected Windows system, commonly through phishing, malware execution, exploitation of another application, or abuse of valid but low-privileged credentials. The attacker then runs a purpose-built exploit that interacts with the Desktop Window Manager/Core Library attack surface and triggers memory corruption. If exploitation succeeds, the attacker gains elevated privileges on the host, allowing them to run privileged commands, dump credentials, disable defenses, install persistence, or move laterally. In practical intrusions, this type of vulnerability is commonly chained after initial access and before credential access or domain expansion. The supplied package metadata also references yoctoproject/poky Git content with a fixed commit of e7f0177ef3b6e06b8bc1722fca0241fef08a1530; where that software bill of materials reference is applicable, downstream builds should be updated to that commit or later.

How to fix it

Apply the Microsoft security updates that address this November 2023 Windows Desktop Window Manager Core Library elevation-of-privilege vulnerability across all affected Windows systems. Prioritize endpoints and servers where untrusted users can log on, where remote access is enabled, and where prior compromise is suspected. Because this issue is in the KEV catalog and exploitation has been observed, remediation should be treated as urgent even though exploitation requires local access. If maintaining Yocto Project/poky Git content referenced by the input metadata, update to commit e7f0177ef3b6e06b8bc1722fca0241fef08a1530 or later and rebuild affected artifacts. Where immediate patching is not possible, reduce exposure by restricting interactive logon rights, limiting local user privileges, enforcing application control, enabling EDR behavior blocking, and isolating high-risk systems until patched.

How to confirm the fix worked

Confirm that all affected Windows systems have the relevant November 2023 or later cumulative security updates installed and that the build level matches Microsoft’s fixed versions for the deployed Windows release. Validate through endpoint management, vulnerability scanners, authenticated patch scans, and local checks such as installed hotfix/build inventory. For systems built from Yocto Project/poky metadata, verify the repository includes commit e7f0177ef3b6e06b8bc1722fca0241fef08a1530 or a later commit containing the fix, then confirm rebuilt images or packages were deployed. After remediation, perform authenticated rescans and confirm the vulnerability is no longer reported. For higher assurance, review for abnormal DWM crashes, suspicious privilege changes, and post-exploitation activity before declaring affected assets clean.

Typical attack path

1. Gain initial local code execution on an affected Windows system using malware, phishing, stolen credentials, or another vulnerability.
2. Confirm the operating system build is vulnerable and that the Desktop Window Manager components are present.
3. Execute a local privilege-escalation exploit targeting the DWM Core Library memory-corruption flaw.
4. Obtain elevated privileges on the host.
5. Use elevated access to dump credentials, disable security controls, install persistence, or access sensitive data.
6. Use the compromised host as a staging point for lateral movement or broader compromise.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry and Windows logs for signs of a local privilege-escalation chain rather than relying on a single definitive indicator. Useful sources include EDR process trees, Windows Security logs, Sysmon logs, Windows Error Reporting events, application crash logs, service creation events, scheduled task creation events, PowerShell logs, Defender/EDR alerts, and local group membership changes. Look for crashes or abnormal behavior involving dwm.exe or dwmcore.dll followed closely by elevated process execution, new administrator-level processes, credential dumping tools, LSASS access, security tool disablement, new services, new scheduled tasks, or unexpected persistence. Because this is a local elevation-of-privilege issue, suspicious activity will usually appear after an initial access event and before higher-privilege actions. If threat hunting across historical logs, focus on activity since publication on 2023-11-14 and especially any unpatched period before the KEV due date of 2023-12-05. Absence of DWM crash artifacts does not rule out exploitation; prioritize behavior-based correlation around privilege changes and post-exploitation actions.

• dwm.exe
• dwmcore.dll
• \Windows\System32\dwm.exe
• \Windows\System32\dwmcore.dll
• Faulting application name: dwm.exe
• Faulting module name: dwmcore.dll
• Desktop Window Manager
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 7045
• Event ID 4698
• Event ID 4732
• Event ID 4738
• SeDebugPrivilege
• lsass.exe

What your security team should do

• Immediately verify patch status for all Windows assets because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Prioritize remediation for internet-managed endpoints, shared workstations, developer systems, jump hosts, and systems used by privileged administrators.
• Run retrospective threat hunts for local privilege escalation followed by credential dumping, defense evasion, new services, suspicious scheduled tasks, or abnormal administrator group changes.
• Correlate endpoint telemetry around dwm.exe or dwmcore.dll crashes with subsequent elevated process creation or security control tampering.
• Ensure EDR, Windows Defender, Attack Surface Reduction rules, and application control policies are enabled and monitored.
• Review least-privilege controls and remove unnecessary local administrator rights to reduce the value of successful exploitation.
• If Yocto Project/poky content is in scope, update to commit e7f0177ef3b6e06b8bc1722fca0241fef08a1530 or later and regenerate affected images.
• Document exception handling for any systems that cannot be patched and apply compensating controls such as network isolation and restricted logon.