PT-2023-5126 · Microsoft · Windows 11+1

Carrot_C4K3 + 4 · Published 2023-09-12 · Updated 2025-01-18 · CVE-2023-38146

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 11 (affected versions not specified)

Description The vulnerability is related to insufficient input validation in the Windows Themes component, allowing remote attackers to execute arbitrary code on the system. This can occur when a user opens a malicious .THEME file. The issue has been exploited in real-world incidents, with proof-of-concept exploit code published. A successful exploit could grant attackers complete control over the victim's system, allowing them to install malware, steal sensitive data, or launch further attacks within the network.

Recommendations To resolve the issue, install Microsoft's September 2023 security updates as soon as possible to protect your system from attacks. The updates are available through Windows Update and the Microsoft Update Catalog. As a temporary workaround, consider avoiding the use of .THEME files from untrusted sources until the issue is resolved.

Exploit

Fix

RCE

DoS

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

CWE-20

Related Identifiers

BDU:2023-05717

CVE-2023-38146

Affected Products

Windows

Windows 11

References · 62

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb · Exploit
• 🔥 https://github.com/gabe-k/themebleed · Exploit
• 🔥 https://github.com/exploits-forsale/themebleed · Exploit
• 🔥 https://github.com/Jnnshschl/CVE-2023-38146 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-38146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38146 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38146 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05717 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38146 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/698522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38146 · Security Note
• https://twitter.com/Dinosn/status/1702025012876546223 · Twitter Post
• https://twitter.com/fletch_ai/status/1702504256673112526 · Twitter Post
• https://t.me/secharvester/14397 · Telegram Post
• https://twitter.com/nuria_imeq/status/1703141377373028783 · Twitter Post