CVE-2023-36563

What it actually does

This is a Microsoft WordPad information disclosure vulnerability affecting supported Windows client and server versions. Exploitation requires user interaction: a victim must open a specially crafted file, typically delivered by email, web download, or another social-engineering channel. Successful exploitation can disclose high-value local information to the attacker, but it does not directly provide code execution, privilege escalation, integrity modification, or denial of service. Because the CVSS vector is local with required user interaction and high confidentiality impact, the primary risk is leakage of sensitive data from the affected endpoint or server session rather than direct system takeover.

Why it matters to the business

An attacker who convinces a user to open a malicious document can expose sensitive information from Windows systems, potentially including data that helps with follow-on compromise, credential theft, phishing, or lateral movement. This vulnerability is listed in CISA KEV with active exploitation in the wild and had a federal remediation deadline of 2023-10-31, so unpatched systems should be treated as overdue and higher priority despite the medium CVSS score. Impact is especially relevant for organizations that exchange documents with external parties or allow WordPad-associated document types on endpoints and servers.

How an attack unfolds

An attacker prepares a malicious document designed to trigger the WordPad information disclosure flaw when parsed or opened on an affected Windows version. The attacker then delivers the file through a channel likely to result in user interaction, such as phishing email, a shared file link, messaging platform, compromised website, or removable media. When the victim opens the crafted file with WordPad or a WordPad-associated handler, the vulnerability causes sensitive local information to be exposed. The attacker can then use the disclosed information to improve targeting, obtain additional secrets, bypass assumptions about the host or user context, or support a later-stage intrusion. Public reporting and CISA KEV status indicate this vulnerability has been exploited in the wild; however, no specific ransomware association is indicated in the provided data.

How to fix it

Apply the Microsoft security updates that address CVE-2023-36563 for all affected Windows versions, including Windows 10, Windows 11, and Windows Server 2008/2012/2016/2019/2022 where applicable. Because this issue is in CISA KEV and known exploited, prioritize patching any internet-facing, high-risk, shared-use, or document-processing systems first, followed by all remaining endpoints and servers. If immediate patching is not possible, reduce exposure by blocking or quarantining untrusted document attachments, disabling unnecessary WordPad file associations, restricting WordPad execution where business processes permit, enforcing attachment detonation/sandboxing, and using application control to prevent users from opening untrusted document formats with vulnerable handlers. Ensure Microsoft Defender, EDR, email security, and web filtering signatures are current.

How to confirm the fix worked

Confirm that Windows security updates released by Microsoft for this vulnerability have been installed on all affected Windows 10, Windows 11, and Windows Server systems. Validate through enterprise patch management, vulnerability scanners, endpoint inventory, and direct host checks using installed update history or Windows Update compliance reporting. Test that untrusted document attachments are blocked, sandboxed, or inspected before user access. Where mitigations were used instead of patching, verify that WordPad execution or relevant file associations are actually restricted for standard users. Re-scan endpoints after remediation to confirm the vulnerability is no longer reported and spot-check high-risk systems manually.

Typical attack path

1. Identify organizations or users likely to open externally supplied documents.
2. Craft or obtain a malicious file that triggers the WordPad information disclosure condition on vulnerable Windows versions.
3. Deliver the file through phishing, file-sharing links, web downloads, messaging platforms, or another social-engineering channel.
4. Convince the user to open the file on an affected Windows client or server.
5. Trigger WordPad processing of the crafted content and obtain disclosed sensitive information.
6. Use the exposed information for follow-on actions such as credential targeting, internal reconnaissance, or more convincing social engineering.

How to detect it

To determine whether this vulnerability was already exploited, focus on user-driven document execution and suspicious WordPad activity. Review EDR and Windows event telemetry for WordPad launches shortly after email receipt, browser downloads, archive extraction, or file-share access. Useful sources include endpoint process creation logs, Microsoft Defender for Endpoint advanced hunting data, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Windows Security Event ID 4688 process creation if enabled, email gateway logs, web proxy logs, browser download history, and EDR file provenance. Look for wordpad.exe opening files from Downloads, Temp, Outlook/Office attachment cache, browser cache, ZIP extraction directories, network shares, or removable media. Investigate WordPad activity followed by unusual outbound network connections, credential access alerts, archive creation, scripting interpreter execution, or access to sensitive local files. Since the flaw is information disclosure and may not leave a unique exploit artifact, absence of a distinct IOC does not rule out exploitation; correlation of suspicious document provenance, WordPad execution, and subsequent attacker behavior is required.

• wordpad.exe
• %ProgramFiles%\Windows NT\Accessories\wordpad.exe
• C:\Program Files\Windows NT\Accessories\wordpad.exe
• \AppData\Local\Temp\
• \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\
• \AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\
• \Downloads\
• EventCode=4688 NewProcessName=*\wordpad.exe
• EventID=1 Image=*\wordpad.exe
• ProcessName=wordpad.exe ParentImage=*\OUTLOOK.EXE
• ProcessName=wordpad.exe ParentImage=*\chrome.exe
• ProcessName=wordpad.exe ParentImage=*\msedge.exe
• ProcessName=wordpad.exe ParentImage=*\firefox.exe
• ProcessName=wordpad.exe ParentImage=*\explorer.exe CommandLine=*\AppData\Local\Temp\*
• ProcessName=wordpad.exe CommandLine=*\Downloads\*
• ProcessName=wordpad.exe CommandLine=*Content.Outlook*

What your security team should do

• Treat this as an actively exploited KEV vulnerability and prioritize remediation on all affected Windows endpoints and servers that remain unpatched.
• Use centralized patch management to verify installation of the applicable Microsoft security updates across Windows 10, Windows 11, and Windows Server fleets.
• Hunt for suspicious document-delivery activity around the publication and KEV remediation window, especially email attachments or downloaded files opened with WordPad.
• Temporarily restrict WordPad execution or untrusted document opening on systems that cannot be patched immediately.
• Increase scrutiny of inbound document attachments using sandboxing, content disarm and reconstruction, and phishing detection controls.
• Review EDR telemetry for WordPad spawning unusual child processes, accessing unexpected files, or being launched from email, browser, archive, or temporary download locations.
• Educate users to avoid opening unexpected document attachments or files from unknown sources, especially on systems not yet confirmed patched.
• Document and track any exceptions where legacy Windows Server or endpoint versions cannot be patched promptly, and apply compensating controls.