CVE-2023-29363: Windows PGM RCE Vulnerability

CVE-2023-29363 Overview

CVE-2023-29363 is a critical remote code execution vulnerability affecting the Windows Pragmatic General Multicast (PGM) protocol implementation. PGM is a reliable multicast transport protocol that enables receivers to detect loss, request retransmission of lost data, or notify applications of unrecoverable loss. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected Windows systems where the Message Queuing service is enabled.

The vulnerability exists in how Windows handles PGM protocol messages, potentially allowing attackers to exploit the flaw over the network without requiring any user interaction or prior authentication. Systems running the Windows Message Queuing service with PGM enabled are at risk of complete compromise.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise with full control over confidentiality, integrity, and availability of affected Windows systems running the Message Queuing service.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2)
• Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022

Discovery Timeline

• June 14, 2023 - CVE-2023-29363 published to NVD
• April 8, 2025 - Last updated in NVD database

Technical Details for CVE-2023-29363

Vulnerability Analysis

This vulnerability is classified as a Heap-based Buffer Overflow (CWE-122) in the Windows Pragmatic General Multicast protocol implementation. The flaw resides in the kernel-mode driver responsible for processing PGM protocol messages when the Message Queuing (MSMQ) service is running.

The vulnerability can be exploited remotely over the network without requiring any privileges or user interaction, making it particularly dangerous for exposed systems. When successfully exploited, an attacker can execute arbitrary code with SYSTEM privileges, leading to complete system compromise.

The attack surface is limited to systems where the Message Queuing service is installed and running. By default, this service is not enabled on most Windows installations, but it is commonly found in enterprise environments that rely on message queuing functionality for application communication.

Root Cause

The root cause of CVE-2023-29363 is a heap-based buffer overflow (CWE-122) in the Windows PGM protocol handler. When processing specially crafted PGM packets, the vulnerable code fails to properly validate the size of incoming data before copying it to a heap-allocated buffer. This allows an attacker to write data beyond the allocated buffer boundaries, corrupting adjacent heap memory structures and potentially gaining control of code execution flow.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by sending specially crafted PGM protocol packets to a Windows system running the Message Queuing service. The attack requires:

1. The target system must have Message Queuing service (MSMQ) installed and running
2. Network connectivity to the target system on the PGM port
3. No authentication or user interaction is required

The vulnerability is exploited through malformed multicast protocol messages that trigger the heap overflow condition in kernel space, allowing the attacker to achieve remote code execution with SYSTEM-level privileges.

Detection Methods for CVE-2023-29363

Indicators of Compromise

• Unusual network traffic on UDP port 3389 or other PGM-related ports targeting Windows systems
• Unexpected crashes or instability in the Message Queuing service (mqsvc.exe)
• Kernel-mode crash dumps indicating heap corruption in PGM-related drivers
• Suspicious outbound connections from systems running MSMQ after receiving multicast traffic

Detection Strategies

• Monitor for anomalous PGM protocol traffic patterns, particularly malformed or oversized packets
• Deploy network intrusion detection systems (NIDS) with signatures for CVE-2023-29363 exploitation attempts
• Enable Windows Event logging for Message Queuing service events and monitor for service crashes or restarts
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities following heap corruption attacks

Monitoring Recommendations

• Implement network segmentation to restrict PGM/multicast traffic to only necessary systems
• Configure Windows Firewall rules to limit inbound traffic to the Message Queuing service
• Enable audit logging for service state changes on systems running MSMQ
• Deploy endpoint detection and response (EDR) solutions capable of detecting kernel-mode exploitation attempts

How to Mitigate CVE-2023-29363

Immediate Actions Required

• Apply the Microsoft security update released in June 2023 immediately to all affected systems
• If patching is not immediately possible, disable the Message Queuing service on systems where it is not required
• Implement network-level filtering to block malicious PGM traffic at perimeter firewalls
• Conduct an inventory to identify all systems with MSMQ installed and prioritize patching

Patch Information

Microsoft has released security updates to address this vulnerability as part of their June 2023 Patch Tuesday release. The official security advisory and patch information is available at the Microsoft Security Response Center. Organizations should prioritize applying these updates to all affected Windows systems, particularly servers running the Message Queuing service.

Workarounds

• Disable the Message Queuing service (msmq) on systems where it is not required using Services management console or PowerShell
• Block PGM traffic at network boundaries using firewall rules to prevent external exploitation
• Implement network segmentation to isolate systems that require MSMQ from untrusted networks
• Consider using Windows Firewall to restrict which systems can communicate with the MSMQ service

# Disable Message Queuing service via PowerShell
Stop-Service -Name "MSMQ" -Force
Set-Service -Name "MSMQ" -StartupType Disabled

# Verify service status
Get-Service -Name "MSMQ" | Select-Object Name, Status, StartType