CVE-2023-21765: Windows 10 Privilege Escalation Flaw

CVE-2023-21765 Overview

CVE-2023-21765 is an elevation of privilege vulnerability in the Windows Print Spooler service. The flaw allows an authenticated local attacker to gain higher privileges on a compromised Windows system. Microsoft addressed the issue as part of the January 2023 Patch Tuesday release.

The vulnerability affects a broad range of Windows desktop and server products, including Windows 10, Windows 11, Windows 7, Windows 8.1, and Windows Server versions from 2008 through 2022. The root cause is associated with an integer overflow or wraparound condition tracked under [CWE-190].

Critical Impact
A successful exploit grants the attacker SYSTEM-level privileges, enabling full control over the affected host and the ability to install programs, modify data, or create privileged accounts.

Affected Products

Microsoft Windows 10 (1607, 1809, 20H2, 21H2, 22H2) and Windows 11 (21H2, 22H2) on x64 and ARM64
Microsoft Windows 7 SP1, Windows 8.1, and Windows RT 8.1
Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022

Discovery Timeline

2023-01-10 - CVE-2023-21765 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-21765

Vulnerability Analysis

The Windows Print Spooler (spoolsv.exe) is a long-standing target for privilege escalation research due to its complex IPC surface and its operation under the NT AUTHORITY\SYSTEM security context. CVE-2023-21765 is an elevation of privilege issue exposed to local, authenticated users.

The weakness is categorized as an integer overflow or wraparound [CWE-190]. Such conditions occur when arithmetic on a length or size field exceeds the bounds of its data type, leading to undersized buffer allocations or incorrect bounds checks downstream. In privileged services like the Print Spooler, this class of defect can be coerced into memory corruption that subverts the integrity of the service.

Exploitation requires the attacker to already hold valid credentials on the target system. No user interaction is needed, and the attack complexity is low.

Root Cause

The underlying defect involves improper arithmetic validation within the Print Spooler service. When a size or count value wraps around its boundary, the service performs allocations or copies based on the truncated value. The result is an inconsistent view of memory that an attacker can manipulate to overwrite adjacent structures.

Attack Vector

An attacker authenticates locally with standard user permissions and interacts with the Print Spooler service through its documented RPC and named pipe interfaces. By submitting crafted print job metadata or printer configuration data that triggers the integer overflow, the attacker corrupts spooler state to execute attacker-controlled logic in the SYSTEM context. The vulnerability cannot be reached remotely without prior code execution on the host.

No verified public proof-of-concept code is available for this CVE. Refer to the Microsoft Security Update Guide entry for CVE-2023-21765 for vendor technical details.

Detection Methods for CVE-2023-21765

Indicators of Compromise

Unexpected child processes spawned by spoolsv.exe, particularly cmd.exe, powershell.exe, or rundll32.exe running as SYSTEM
Creation or modification of files under C:\Windows\System32\spool\drivers\ by non-administrative users
New printer driver or port installations originating from interactive user sessions without administrator approval
Crashes of spoolsv.exe logged in the Application event log preceding privileged account activity

Detection Strategies

Monitor process lineage where spoolsv.exe is the parent of interactive shells or script interpreters
Hunt for loads of unsigned or unusual DLLs into the Print Spooler service via Sysmon Event ID 7
Correlate local logon events with subsequent SYSTEM-level token assignments on the same host
Apply behavioral identification rules that flag privilege escalation patterns following standard user authentication

Monitoring Recommendations

Enable Print Service operational and admin event logs and forward them to a centralized SIEM or data lake
Track changes to the HKLM\SYSTEM\CurrentControlSet\Control\Print registry hive
Alert on installation of new print drivers using PrintDriverInstalled and related WMI events
Baseline normal Print Spooler memory and CPU usage to surface anomalous crashes or restarts

How to Mitigate CVE-2023-21765

Immediate Actions Required

Apply the January 2023 Microsoft security updates that remediate CVE-2023-21765 to all affected Windows desktop and server systems
Inventory hosts still running the Print Spooler service and prioritize patching domain controllers, jump hosts, and shared infrastructure
Restrict local logon rights on sensitive systems to reduce the population of users who can reach the local attack surface
Audit existing print driver installations and remove unused or untrusted drivers

Patch Information

Microsoft released a security update for CVE-2023-21765 on January 10, 2023. Patch availability and supported builds for each affected Windows release are listed in the Microsoft Security Update Guide entry for CVE-2023-21765. Administrators should deploy the appropriate cumulative update or monthly rollup for their specific Windows version.

Workarounds

Disable the Print Spooler service (Stop-Service Spooler; Set-Service Spooler -StartupType Disabled) on systems that do not require printing, such as domain controllers and most servers
Use Group Policy Computer Configuration > Administrative Templates > Printers > Allow Print Spooler to accept client connections set to Disabled to block remote print operations
Restrict the Point and Print Restrictions policy to require administrator approval for driver installation and updates
Limit the set of users with interactive logon rights on systems where the spooler must remain active

bash

# Configuration example: disable the Print Spooler service on hosts that do not print
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify the service state
Get-Service -Name Spooler | Format-List Name, Status, StartType