Windows 11 21H2 CVE-2023-38146

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2023-09-12 secure@microsoft.com

RCE Microsoft Windows 11 21H2 Windows 11 22h2

8.8

CVSS 3.1 · Vendor: microsoft

Share

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Sep 12, 2023 - 17:15 cve.org

HIGH 8.8

DescriptionCVE.org

Windows Themes Remote Code Execution Vulnerability

AnalysisAI

Windows Themes Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-367. Affected products include: Microsoft Windows 11 21H2, Microsoft Windows 11 22H2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Windows 11 21H2

View all

CVE-2021-34527 HIGH Act Now POC

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi

CVE-2022-30190 HIGH Act Now POC

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f

CVE-2023-36884 HIGH Act Now POC

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

CVE-2024-21412 HIGH Act Now POC

Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem

CVE-2023-44487 HIGH Act Now POC

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2024-30088 HIGH Act Now POC

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR

CVE-2024-21338 HIGH Act Now POC

Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co

CVE-2024-35250 HIGH Act Now POC

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l

CVE-2024-43461 HIGH Act Now

Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab

CVE-2022-41128 HIGH Act Now

Windows Scripting Languages Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is r

CVE-2024-21351 HIGH Act Now

Windows SmartScreen Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is remotel

CVE-2024-38217 MEDIUM Act Now POC

Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all

CVE-2024-30088 HIGH POC

CVE-2025-22224 CRITICAL

CVE-2025-38352 HIGH POC

CVE-2022-48618 HIGH

CVE-2025-34027 CRITICAL POC

CVE-2020-1337 HIGH POC

CVE-2026-25641 CRITICAL POC

CVE-2024-28718 CRITICAL POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2023-38146 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy