CVE-2023-21767 Overview
CVE-2023-21767 is an elevation of privilege vulnerability in the Windows Overlay Filter (wof.sys) driver. The flaw affects supported versions of Windows client and server operating systems, including Windows 10, Windows 11, Windows 8.1, and Windows Server 2012 through 2022. A local attacker with low-privileged access can exploit the vulnerability to elevate to SYSTEM-level privileges. Microsoft addressed the issue in the January 2023 Patch Tuesday release. The vulnerability is classified under [CWE-20: Improper Input Validation].
Critical Impact
Successful exploitation grants SYSTEM-level privileges on the local machine, enabling full control over the compromised host, including credential theft, persistence, and lateral movement preparation.
Affected Products
- Microsoft Windows 10 (1607, 1809, 20H2, 21H2, 22H2) and Windows 11 (21H2, 22H2) on x64 and ARM64
- Microsoft Windows 8.1 and Windows RT 8.1
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-01-10 - CVE-2023-21767 published to NVD and Microsoft releases security patch
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-21767
Vulnerability Analysis
The vulnerability resides in the Windows Overlay Filter, a file system filter driver (wof.sys) that supports compact OS and single-instance storage features. The driver fails to properly validate input received from user-mode callers. An attacker who can execute code locally with standard user rights can trigger the flawed code path and obtain SYSTEM privileges.
Windows Overlay Filter mediates layered file system views, which means it processes structured requests from user mode and reflects them into kernel structures. When input validation is incomplete, attacker-supplied data reaches sensitive operations and corrupts kernel state. The result is a local privilege escalation primitive within the kernel boundary.
Root Cause
The root cause is [CWE-20: Improper Input Validation] within wof.sys. The driver does not sufficiently validate parameters supplied through its user-mode interface before acting on them. Microsoft has not publicly disclosed the specific code path or structure that fails validation.
Attack Vector
Exploitation requires local code execution with low privileges and no user interaction. An attacker first obtains a foothold on the target through phishing, a malicious application, or a separate remote vulnerability. They then issue crafted requests to the Windows Overlay Filter driver to trigger the validation flaw and elevate privileges to SYSTEM. The attack complexity is low and exploitation can be fully automated once a foothold exists.
No public proof-of-concept code is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.83% (74th percentile).
Detection Methods for CVE-2023-21767
Indicators of Compromise
- Unexpected processes spawning cmd.exe, powershell.exe, or services.exe as NT AUTHORITY\SYSTEM from a standard-user parent process
- Loading or interaction with wof.sys from non-system binaries running in user context
- New scheduled tasks, services, or local accounts created shortly after a low-privilege user session is established
Detection Strategies
- Hunt for token manipulation patterns where a process's integrity level transitions from Medium to System without a legitimate elevation event such as UAC or a signed installer
- Monitor for anomalous handle opens to \\.\WofDevice or other Windows Overlay Filter device objects from unsigned or unusual binaries
- Correlate kernel driver interaction telemetry with subsequent privilege changes on the same host to surface exploitation chains
Monitoring Recommendations
- Enable Windows Defender Application Control or AppLocker logging to capture untrusted binaries that may stage local exploits
- Forward Sysmon Event ID 1 (process create) and Event ID 10 (process access) to a centralized analytics platform for behavioral review
- Alert on creation of SYSTEM-owned child processes from interactive user sessions, especially from %TEMP%, %APPDATA%, or user-writable directories
How to Mitigate CVE-2023-21767
Immediate Actions Required
- Apply the January 2023 Microsoft security updates to all affected Windows client and server systems
- Prioritize patching on multi-user systems, jump hosts, and Remote Desktop Services servers where multiple low-privileged users have shell access
- Audit local administrator group membership and remove unnecessary standing privileges to limit post-exploitation impact
Patch Information
Microsoft released fixes through the January 10, 2023 Patch Tuesday update cycle. Refer to the Microsoft Security Update Guide for CVE-2023-21767 for the specific KB articles that apply to each operating system version. Install the cumulative update for your build to remediate the flaw in wof.sys.
Workarounds
- No official vendor workaround exists; patching is the supported remediation path
- Restrict the ability of untrusted users to execute arbitrary binaries through application control policies until patches are deployed
- Reduce local attack surface by enforcing least privilege and isolating high-value workloads from general-purpose user environments
# Verify patch status on Windows hosts via PowerShell
Get-HotFix | Where-Object { $_.InstalledOn -ge [datetime]'2023-01-10' } | Sort-Object InstalledOn
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
