CVE-2023-38146 is a critical Remote Code Execution vulnerability affecting Microsoft Windows 11 (versions 21H2 and 22H2), allowing an attacker to execute arbitrary code through malicious theme files. With a CVSS score of 8.8 (High), it requires user interaction but has low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While not on the KEV catalog, a Metasploit module named "Themebleed" exists, and the vulnerability has garnered significant community discussion and media coverage, indicating high exploitability potential.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.22000.2416CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* | ||
< 10.0.22621.2275CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.