CVE-2023-21674 Overview
CVE-2023-21674 is an elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) subsystem. The flaw is a use-after-free condition [CWE-416] that allows a local, authenticated attacker to escape the browser sandbox and execute code with SYSTEM privileges. Microsoft confirms exploitation in the wild, and CISA added the issue to its Known Exploited Vulnerabilities catalog. The vulnerability affects supported releases of Windows 10, Windows 11, and Windows Server. EPSS data reports an exploitation probability of 11.576% at the 93.72 percentile, reflecting active interest from threat actors.
Critical Impact
Successful exploitation grants kernel-level privileges, enabling full host compromise from any low-privileged user context.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2) and Windows RT 8.1
- Microsoft Windows Server 2012, 2016, 2019, and 2022
Discovery Timeline
- 2023-01-10 - CVE-2023-21674 published to NVD
- 2025-10-30 - Last updated in NVD database
Technical Details for CVE-2023-21674
Vulnerability Analysis
The Advanced Local Procedure Call (ALPC) facility is an internal Windows inter-process communication mechanism used by user-mode subsystems and kernel components. CVE-2023-21674 is a use-after-free condition in ALPC message handling. An attacker who can deliver a malformed ALPC sequence triggers reuse of a freed kernel object, which leads to controlled memory access in the kernel context. The bug is reachable from low-integrity processes, including sandboxed browser renderer processes, which makes it a viable sandbox escape primitive.
Root Cause
The root cause is improper lifetime management of an internal ALPC object [CWE-416]. The kernel dereferences an object pointer after the backing allocation has been released, allowing an attacker to influence the contents of the reused memory. Successful manipulation converts the dangling reference into an arbitrary read or write primitive against kernel structures.
Attack Vector
Exploitation requires local code execution with low privileges (PR:L, UI:N). Attackers chain this issue with a browser remote code execution bug to escape the renderer sandbox and obtain SYSTEM. The scope changes from the compromised process to the kernel, which is reflected in the scope-changed CVSS vector and the impact across confidentiality, integrity, and availability.
No verified public proof-of-concept code is available. The Microsoft Security Response Center advisory at Microsoft CVE-2023-21674 Advisory is the authoritative technical reference.
Detection Methods for CVE-2023-21674
Indicators of Compromise
- Browser renderer or sandboxed child processes (for example chrome.exe, msedge.exe content processes) spawning child processes running as NT AUTHORITY\SYSTEM.
- Unexpected token elevation events on user workstations where a non-elevated process suddenly executes with SYSTEM integrity.
- Crash dumps referencing ntoskrnl.exe ALPC routines or BugCheck 0x3B/0x7E traces shortly after browser activity.
Detection Strategies
- Hunt for parent-child process anomalies where Internet-facing applications launch LOLBins (cmd.exe, powershell.exe, rundll32.exe) at SYSTEM integrity.
- Correlate Windows Defender Exploit Guard and Event Tracing for Windows (ETW) kernel events with browser exploitation telemetry.
- Apply behavioral identification rules that flag privilege transitions from medium or low integrity to SYSTEM without an interactive logon.
Monitoring Recommendations
- Enable verbose process creation logging (Event ID 4688) with command-line auditing across endpoints and servers.
- Forward Sysmon process, image load, and access token events to a central data lake for retrospective hunting.
- Track patch deployment status against the affected Windows builds and alert on hosts missing the January 2023 cumulative update.
How to Mitigate CVE-2023-21674
Immediate Actions Required
- Apply the January 2023 Microsoft security updates referenced in the Microsoft CVE-2023-21674 Advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize internet-facing workstations and systems used for web browsing, since the bug is paired with browser exploits for sandbox escape.
- Review the CISA Known Exploited Vulnerability entry and meet the federal remediation due date as a baseline for enterprise SLAs.
Patch Information
Microsoft addressed CVE-2023-21674 in the January 10, 2023 Patch Tuesday cumulative updates for all supported Windows client and server editions. Refer to the vendor advisory for KB article numbers that map to each affected build. No supported workaround replaces the kernel fix.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation.
- Restrict local logon rights and enforce least privilege to reduce the population of users who can launch exploit code.
- Maintain up-to-date browser versions and enable site isolation to raise the cost of chaining a renderer RCE with this local privilege escalation.
# Verify the January 2023 cumulative update is installed
wmic qfe get HotFixID,InstalledOn | findstr /I "KB502"
# Alternative using PowerShell
Get-HotFix | Where-Object { $_.InstalledOn -ge [datetime]'2023-01-10' } | Sort-Object InstalledOn
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
