PT-2023-1014

CVE-2023-21674

Published

2023-01-10

Updated

2026-07-19

Description by

CVSS 3.1

8.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description An elevation of privilege issue exists in the Windows kernel Advanced Local Procedure Call (ALPC) subsystem. The flaw is caused by a use-after-free condition where an ALPC message retains a pointer to a thread, known as WaitingThread, after the thread has been freed. This creates a dangling pointer that the kernel may later dereference, potentially allowing an attacker to execute arbitrary code with SYSTEM privileges. This issue has been exploited in the wild to facilitate sandbox escapes from the Chromium browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts