Executive brief
Microsoft Streaming Service contains an untrusted pointer dereference vulnerability (CWE-822) that allows for local privilege escalation. A successful exploit enables an attacker to gain SYSTEM privileges on the affected Windows operating system.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 21H2, 22H2
- Microsoft Windows Server 2016, 2019, 2022
Timeline
- 2023-06-13: disclosed: Initial Microsoft advisory publication date (implied by CVE year and patch cycle)
- 2024-02-29: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2024-02-29: advisory: NVD publication date
- 2024-03-21: other: CISA due date for remediation
- 2024-02-29: exploited: Confirmed exploited in the wild per CISA KEV entry