CVE-2023-21684 Overview
CVE-2023-21684 is a remote code execution vulnerability in the Microsoft PostScript and PCL6 Class Printer Driver. The flaw stems from an integer underflow condition [CWE-191] in the driver code shipped with supported versions of Windows and Windows Server. An authenticated attacker on the network can trigger the underflow to execute arbitrary code in the context of the vulnerable driver. Microsoft published the advisory on February 14, 2023 as part of its monthly security update cycle.
Critical Impact
Successful exploitation grants attackers code execution with high impact to confidentiality, integrity, and availability across a broad range of Windows desktop and server SKUs.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2 and 22H2)
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-02-14 - CVE-2023-21684 published to NVD by Microsoft
- 2023-02-14 - Microsoft releases security patch via Patch Tuesday
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-21684
Vulnerability Analysis
The vulnerability resides in the Microsoft PostScript and PCL6 Class Printer Driver, a system component used to render print jobs for PostScript and PCL6-compatible printers. Microsoft classifies the flaw as a remote code execution issue with an integer underflow weakness [CWE-191]. An attacker authenticated to the target network can supply crafted print data or driver input that causes an unsigned arithmetic operation to wrap below zero. The resulting value is later used as a length or index, leading to out-of-bounds memory access and corruption of adjacent structures. Code execution occurs in the security context of the driver process handling the malformed input.
Root Cause
The root cause is an integer underflow when the driver computes the size of a buffer or offset based on attacker-influenced fields. Insufficient validation of the input length before the subtraction operation allows the value to underflow into a large unsigned integer. The driver subsequently treats the corrupt value as trusted, breaking memory safety assumptions during print job processing.
Attack Vector
The attack vector is network-based and requires low privileges with no user interaction. An attacker can deliver a malicious print job, driver configuration, or rendering request to a system or print server that exposes the PostScript or PCL6 driver. Common entry points include shared printer queues, network-accessible spooler services, and document workflows that invoke the affected driver. Microsoft does not list this CVE in CISA KEV, and no public exploit has been released.
No verified public proof-of-concept code is available. Refer to the Microsoft Security Update Guide CVE-2023-21684 for vendor-supplied technical context.
Detection Methods for CVE-2023-21684
Indicators of Compromise
- Unexpected crashes or restarts of spoolsv.exe or PrintIsolationHost.exe correlated with print job submissions
- Anomalous child processes spawned by the print spooler service, particularly command interpreters or scripting hosts
- Print job submissions originating from unusual internal or external network sources targeting print servers
Detection Strategies
- Hunt for process lineage where spoolsv.exe or PrintIsolationHost.exe launches cmd.exe, powershell.exe, or rundll32.exe
- Monitor Windows event logs for crashes in print driver modules, including PrintConfig.dll and PostScript/PCL6 rendering components
- Inspect SMB and RPC traffic to print servers for malformed print job payloads and anomalous spool file sizes
Monitoring Recommendations
- Centralize Windows print service logs and spooler operational events for retention and correlation
- Track installation and modification of printer drivers across endpoints and print servers
- Alert on accounts adding new printer connections from low-trust segments or unusual workstations
How to Mitigate CVE-2023-21684
Immediate Actions Required
- Apply the February 2023 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems
- Inventory print servers and endpoints exposing the PostScript and PCL6 Class Printer Driver and prioritize patching
- Restrict network access to print spooler services using firewall rules and segmentation
Patch Information
Microsoft released fixes for CVE-2023-21684 on February 14, 2023. Patch availability and KB article references for each affected Windows and Windows Server version are documented in the Microsoft Security Update Guide CVE-2023-21684. Administrators should deploy the cumulative update corresponding to each operating system build.
Workarounds
- Disable the Print Spooler service on systems that do not require printing functionality
- Remove unused PostScript and PCL6 printer drivers from print servers and endpoints
- Limit who can install printer drivers by enforcing the RestrictDriverInstallationToAdministrators policy
# Disable the Print Spooler service on systems that do not require printing
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
# Restrict printer driver installation to administrators
reg add "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
