CVE-2023-29358 Overview
CVE-2023-29358 is an elevation of privilege vulnerability in the Windows Graphics Device Interface (GDI) component. The flaw affects a broad range of Microsoft Windows desktop and server releases, from Windows Server 2008 through Windows 11 22H2 and Windows Server 2022. Microsoft classifies the weakness as a use-after-free condition ([CWE-416]) in the GDI subsystem. A local, authenticated attacker who successfully exploits the issue can elevate privileges to SYSTEM on the target host.
Critical Impact
Successful exploitation grants SYSTEM-level privileges on the affected Windows host, giving attackers full control over the operating system, installed applications, and user data.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022
Discovery Timeline
- 2023-06-14 - CVE-2023-29358 published to NVD
- 2023-06-14 - Microsoft releases security update addressing the vulnerability
- 2025-04-08 - Last updated in NVD database
Technical Details for CVE-2023-29358
Vulnerability Analysis
The vulnerability resides in the Windows GDI component, a kernel-mode graphics subsystem responsible for rendering text, lines, and shapes for applications. GDI runs with high privileges and processes objects on behalf of user-mode callers, making memory safety errors in this component a frequent privilege escalation vector. Microsoft describes the flaw as an elevation of privilege issue, and the CWE mapping identifies it as a use-after-free condition ([CWE-416]).
Exploitation requires local access and low privileges, with no user interaction. An attacker who obtains code execution as a standard user can leverage the flaw to break out of normal user boundaries and execute code in the context of the SYSTEM account.
Root Cause
The root cause is a use-after-free condition in GDI object handling. The component continues to reference a memory region after it has been freed, allowing an attacker to control the contents of the freed allocation. When GDI subsequently dereferences the dangling pointer, attacker-controlled data is treated as a valid kernel object, leading to corruption of kernel structures.
Attack Vector
The attack vector is local. An attacker must already have the ability to run code on the target system, for example through a phishing payload, a malicious installer, or compromised credentials. Once code execution is established, the attacker triggers a crafted sequence of GDI API calls that allocates, frees, and reuses an object to control the freed memory. Manipulating the use-after-free primitive enables arbitrary read and write in kernel memory, which is then converted into SYSTEM-level code execution.
No public proof-of-concept or exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. Refer to the Microsoft Security Vulnerability CVE-2023-29358 advisory for vendor-supplied technical context.
Detection Methods for CVE-2023-29358
Indicators of Compromise
- Unexpected processes spawning with SYSTEM-level integrity after starting from a standard user session.
- Crash dumps or WerFault.exe events referencing win32k.sys, win32kfull.sys, or gdi32.dll on unpatched systems.
- Unsigned or unusual binaries loading GDI-related modules and immediately performing token manipulation.
Detection Strategies
- Monitor for token impersonation and parent-child process anomalies where a low-privilege process suddenly launches a SYSTEM-context child.
- Hunt for processes invoking large numbers of GDI object creation and deletion calls in tight loops, a common pattern in kernel use-after-free exploitation.
- Correlate kernel crashes in graphics modules with subsequent privilege changes on the same host.
Monitoring Recommendations
- Enable Windows Event Log auditing for process creation (Event ID 4688) and capture command lines for forensic review.
- Forward endpoint telemetry to a centralized analytics platform to baseline normal GDI behavior and alert on outliers.
- Track patch compliance for the June 2023 Microsoft security updates across all Windows endpoints and servers.
How to Mitigate CVE-2023-29358
Immediate Actions Required
- Apply the June 2023 Microsoft security update for every affected Windows 10, Windows 11, and Windows Server release listed in the advisory.
- Inventory endpoints and servers to confirm patch deployment, prioritizing multi-user systems, terminal servers, and developer workstations.
- Restrict local logon rights and remove unnecessary administrative tooling on shared hosts to reduce the attacker's ability to stage local exploits.
Patch Information
Microsoft addressed CVE-2023-29358 as part of its June 2023 Patch Tuesday release. Patch availability and version-specific knowledge base articles are listed on the Microsoft Security Vulnerability CVE-2023-29358 advisory. Administrators should deploy the cumulative update appropriate for each Windows build rather than standalone hotfixes.
Workarounds
- No official workaround is published by Microsoft; patching is the only supported remediation.
- Limit interactive logon to trusted users and enforce application allowlisting to reduce the chance of unauthorized local code execution.
- Apply the principle of least privilege so that compromise of a standard user account yields minimal lateral movement opportunities before patching completes.
# Verify the June 2023 cumulative update is installed on a Windows host
wmic qfe list brief /format:table
# PowerShell alternative listing installed hotfixes sorted by date
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
