CVE-2023-36718 is a Remote Code Execution vulnerability affecting the Microsoft Virtual Trusted Platform Module (vTPM) across various Windows 10, 11, and Server versions. With a CVSS score of 7.8 (High), it presents a significant risk, allowing an attacker with low privileges and high attack complexity to achieve complete compromise of confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and community discussion and media coverage are minimal. This vulnerability was addressed in Microsoft's October 2023 Patch Tuesday.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.10240.20232CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* | ||
< 10.0.14393.6351CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* | ||
< 10.0.17763.4974CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* | ||
< 10.0.19041.3570CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* | ||
< 10.0.19045.3570CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.