Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

CVE Issued by	Tag	CVE ID	CVE Title
Microsoft	.NET and Visual Studio	CVE-2023-33127	.NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft	ASP.NET and Visual Studio	CVE-2023-33170	ASP.NET and Visual Studio Security Feature Bypass Vulnerability
Microsoft	Azure Active Directory	CVE-2023-36871	Azure Active Directory Security Feature Bypass Vulnerability
Microsoft	Azure Active Directory	CVE-2023-35348	Active Directory Federation Service Security Feature Bypass Vulnerability
Microsoft	Microsoft Dynamics	CVE-2023-33171	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft	Microsoft Dynamics	CVE-2023-35335	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft	Microsoft Graphics Component	CVE-2023-33149	Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft	Microsoft Graphics Component	CVE-2023-21756	Windows Win32k Elevation of Privilege Vulnerability
Microsoft	Microsoft Media-Wiki Extensions	CVE-2023-35333	MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
Microsoft	Microsoft Office	CVE-2023-33148	Microsoft Office Elevation of Privilege Vulnerability
Microsoft	Microsoft Office	CVE-2023-36884	Office and Windows HTML Remote Code Execution Vulnerability
Microsoft	Microsoft Office	CVE-2023-33150	Microsoft Office Security Feature Bypass Vulnerability
Microsoft	Microsoft Office Access	CVE-2023-33152	Microsoft ActiveX Remote Code Execution Vulnerability
Microsoft	Microsoft Office Excel	CVE-2023-33158	Microsoft Excel Remote Code Execution Vulnerability
Microsoft	Microsoft Office Excel	CVE-2023-33161	Microsoft Excel Remote Code Execution Vulnerability
Microsoft	Microsoft Office Excel	CVE-2023-33162	Microsoft Excel Information Disclosure Vulnerability
Microsoft	Microsoft Office Outlook	CVE-2023-33151	Microsoft Outlook Spoofing Vulnerability
Microsoft	Microsoft Office Outlook	CVE-2023-33153	Microsoft Outlook Remote Code Execution Vulnerability
Microsoft	Microsoft Office Outlook	CVE-2023-35311	Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft	Microsoft Office SharePoint	CVE-2023-33134	Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft	Microsoft Office SharePoint	CVE-2023-33160	Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft	Microsoft Office SharePoint	CVE-2023-33165	Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft	Microsoft Office SharePoint	CVE-2023-33157	Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft	Microsoft Office SharePoint	CVE-2023-33159	Microsoft SharePoint Server Spoofing Vulnerability
Microsoft	Microsoft Power Apps	CVE-2023-32052	Microsoft Power Apps Spoofing Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-32085	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-35302	Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-35296	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-35324	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-32040	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-35306	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Printer Drivers	CVE-2023-32039	Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft	Microsoft Windows Codecs Library	CVE-2023-35303	USB Audio Class System Driver Remote Code Execution Vulnerability
Microsoft	Microsoft Windows Codecs Library	CVE-2023-36872	VP9 Video Extensions Information Disclosure Vulnerability
Microsoft	Microsoft Windows Codecs Library	CVE-2023-32051	Raw Image Extension Remote Code Execution Vulnerability
Microsoft	Mono Authenticode	CVE-2023-35373	Mono Authenticode Validation Spoofing Vulnerability
Microsoft	Paint 3D	CVE-2023-35374	Paint 3D Remote Code Execution Vulnerability
Microsoft	Paint 3D	CVE-2023-32047	Paint 3D Remote Code Execution Vulnerability
Microsoft	Role: DNS Server	CVE-2023-35310	Windows DNS Server Remote Code Execution Vulnerability
Microsoft	Role: DNS Server	CVE-2023-35346	Windows DNS Server Remote Code Execution Vulnerability
Microsoft	Role: DNS Server	CVE-2023-35345	Windows DNS Server Remote Code Execution Vulnerability
Microsoft	Role: DNS Server	CVE-2023-35344	Windows DNS Server Remote Code Execution Vulnerability
Microsoft	Service Fabric	CVE-2023-36868	Azure Service Fabric on Windows Information Disclosure Vulnerability
Microsoft	Visual Studio Code	CVE-2023-36867	Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
Microsoft	Windows Active Directory Certificate Services	CVE-2023-35351	Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Microsoft	Windows Active Directory Certificate Services	CVE-2023-35350	Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Microsoft	Windows Active Template Library	CVE-2023-32055	Active Template Library Elevation of Privilege Vulnerability
Microsoft	Windows Admin Center	CVE-2023-29347	Windows Admin Center Spoofing Vulnerability
Microsoft	Windows App Store	CVE-2023-35347	Microsoft Install Service Elevation of Privilege Vulnerability
Microsoft	Windows Authentication Methods	CVE-2023-35329	Windows Authentication Denial of Service Vulnerability
Microsoft	Windows CDP User Components	CVE-2023-35326	Windows CDP User Components Information Disclosure Vulnerability
Microsoft	Windows Certificates	ADV230001	Guidance on Microsoft Signed Drivers Being Used Maliciously
Microsoft	Windows Clip Service	CVE-2023-35362	Windows Clip Service Elevation of Privilege Vulnerability
Microsoft	Windows Cloud Files Mini Filter Driver	CVE-2023-33155	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Microsoft	Windows Cluster Server	CVE-2023-32033	Microsoft Failover Cluster Remote Code Execution Vulnerability
Microsoft	Windows CNG Key Isolation Service	CVE-2023-35340	Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Microsoft	Windows Common Log File System Driver	CVE-2023-35299	Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft	Windows Connected User Experiences and Telemetry	CVE-2023-35320	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Microsoft	Windows Connected User Experiences and Telemetry	CVE-2023-35353	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Microsoft	Windows CryptoAPI	CVE-2023-35339	Windows CryptoAPI Denial of Service Vulnerability
Microsoft	Windows Cryptographic Services	CVE-2023-33174	Windows Cryptographic Information Disclosure Vulnerability
Microsoft	Windows Defender	CVE-2023-33156	Microsoft Defender Elevation of Privilege Vulnerability
Microsoft	Windows Deployment Services	CVE-2023-35322	Windows Deployment Services Remote Code Execution Vulnerability
Microsoft	Windows Deployment Services	CVE-2023-35321	Windows Deployment Services Denial of Service Vulnerability
Microsoft	Windows EFI Partition	ADV230002	Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules
Microsoft	Windows Error Reporting	CVE-2023-36874	Windows Error Reporting Service Elevation of Privilege Vulnerability
Microsoft	Windows Failover Cluster	CVE-2023-32083	Microsoft Failover Cluster Information Disclosure Vulnerability
Microsoft	Windows Geolocation Service	CVE-2023-35343	Windows Geolocation Service Remote Code Execution Vulnerability
Microsoft	Windows HTTP.sys	CVE-2023-32084	HTTP.sys Denial of Service Vulnerability
Microsoft	Windows HTTP.sys	CVE-2023-35298	HTTP.sys Denial of Service Vulnerability
Microsoft	Windows Image Acquisition	CVE-2023-35342	Windows Image Acquisition Elevation of Privilege Vulnerability
Microsoft	Windows Installer	CVE-2023-32053	Windows Installer Elevation of Privilege Vulnerability
Microsoft	Windows Installer	CVE-2023-32050	Windows Installer Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35304	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35363	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35305	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35356	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35357	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Kernel	CVE-2023-35358	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows Layer 2 Tunneling Protocol	CVE-2023-32037	Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability
Microsoft	Windows Layer-2 Bridge Network Driver	CVE-2023-35315	Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
Microsoft	Windows Local Security Authority (LSA)	CVE-2023-35331	Windows Local Security Authority (LSA) Denial of Service Vulnerability
Microsoft	Windows Media	CVE-2023-35341	Microsoft DirectMusic Information Disclosure Vulnerability
Microsoft	Windows Message Queuing	CVE-2023-32057	Microsoft Message Queuing Remote Code Execution Vulnerability
Microsoft	Windows Message Queuing	CVE-2023-35309	Microsoft Message Queuing Remote Code Execution Vulnerability
Microsoft	Windows Message Queuing	CVE-2023-32045	Microsoft Message Queuing Denial of Service Vulnerability
Microsoft	Windows Message Queuing	CVE-2023-32044	Microsoft Message Queuing Denial of Service Vulnerability
Microsoft	Windows MSHTML Platform	CVE-2023-32046	Windows MSHTML Platform Elevation of Privilege Vulnerability
Microsoft	Windows MSHTML Platform	CVE-2023-35336	Windows MSHTML Platform Security Feature Bypass Vulnerability
Microsoft	Windows MSHTML Platform	CVE-2023-35308	Windows MSHTML Platform Security Feature Bypass Vulnerability
Microsoft	Windows Netlogon	CVE-2023-21526	Windows Netlogon Information Disclosure Vulnerability
Microsoft	Windows Network Load Balancing	CVE-2023-33163	Windows Network Load Balancing Remote Code Execution Vulnerability
Microsoft	Windows NT OS Kernel	CVE-2023-35361	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows NT OS Kernel	CVE-2023-35364	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows NT OS Kernel	CVE-2023-35360	Windows Kernel Elevation of Privilege Vulnerability
Microsoft	Windows ODBC Driver	CVE-2023-32038	Microsoft ODBC Driver Remote Code Execution Vulnerability
Microsoft	Windows OLE	CVE-2023-32042	OLE Automation Information Disclosure Vulnerability
Microsoft	Windows Online Certificate Status Protocol (OCSP) SnapIn	CVE-2023-35323	Windows OLE Remote Code Execution Vulnerability
Microsoft	Windows Online Certificate Status Protocol (OCSP) SnapIn	CVE-2023-35313	Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability
Microsoft	Windows Partition Management Driver	CVE-2023-33154	Windows Partition Management Driver Elevation of Privilege Vulnerability
Microsoft	Windows Peer Name Resolution Protocol	CVE-2023-35338	Windows Peer Name Resolution Protocol Denial of Service Vulnerability
Microsoft	Windows PGM	CVE-2023-35297	Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Microsoft	Windows Print Spooler Components	CVE-2023-35325	Windows Print Spooler Information Disclosure Vulnerability
Microsoft	Windows Remote Desktop	CVE-2023-35352	Windows Remote Desktop Security Feature Bypass Vulnerability
Microsoft	Windows Remote Desktop	CVE-2023-32043	Windows Remote Desktop Security Feature Bypass Vulnerability
Microsoft	Windows Remote Desktop	CVE-2023-35332	Windows Remote Desktop Protocol Security Feature Bypass
Microsoft	Windows Remote Procedure Call	CVE-2023-35300	Remote Procedure Call Runtime Remote Code Execution Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33168	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33173	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33172	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-32035	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33166	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-32034	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33167	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33169	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-35318	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-33164	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-35319	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-35316	Remote Procedure Call Runtime Information Disclosure Vulnerability
Microsoft	Windows Remote Procedure Call	CVE-2023-35314	Remote Procedure Call Runtime Denial of Service Vulnerability
Microsoft	Windows Routing and Remote Access Service (RRAS)	CVE-2023-35367	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Microsoft	Windows Routing and Remote Access Service (RRAS)	CVE-2023-35366	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Microsoft	Windows Routing and Remote Access Service (RRAS)	CVE-2023-35365	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Microsoft	Windows Server Update Service	CVE-2023-35317	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Microsoft	Windows Server Update Service	CVE-2023-32056	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Microsoft	Windows SmartScreen	CVE-2023-32049	Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft	Windows SPNEGO Extended Negotiation	CVE-2023-35330	Windows Extended Negotiation Denial of Service Vulnerability
Microsoft	Windows Transaction Manager	CVE-2023-35328	Windows Transaction Manager Elevation of Privilege Vulnerability
Microsoft	Windows Update Orchestrator Service	CVE-2023-32041	Windows Update Orchestrator Service Information Disclosure Vulnerability
Microsoft	Windows VOLSNAP.SYS	CVE-2023-35312	Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
Microsoft	Windows Volume Shadow Copy	CVE-2023-32054	Volume Shadow Copy Elevation of Privilege Vulnerability
Microsoft	Windows Win32K	CVE-2023-35337	Win32k Elevation of Privilege Vulnerability

CVE-2023-21756 - Windows Win32k Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21756 MITRE NVD Issuing CNA: Microsoft	CVE Title: Windows Win32k Elevation of Privilege Vulnerability CVSS: CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21756
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Elevation of Privilege	5027230	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Elevation of Privilege	5027230	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Elevation of Privilege	5027219	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Elevation of Privilege	5027219	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Elevation of Privilege	5027222	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Elevation of Privilege	5027222	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Elevation of Privilege	5027222	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Elevation of Privilege	5027215	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Elevation of Privilege	5027223	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Elevation of Privilege	5027223	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Elevation of Privilege	5027231	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Elevation of Privilege	5027231	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Elevation of Privilege	5027283	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Elevation of Privilege	5027283	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Elevation of Privilege	5027271	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Elevation of Privilege	5027271	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Elevation of Privilege	5027219	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Elevation of Privilege	5027219	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Elevation of Privilege	5027222	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Elevation of Privilege	5027222	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Elevation of Privilege	5027225	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Elevation of Privilege	5027225	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21756	Microsoft Input and Composition Servicing team

CVE-2023-33148 - Microsoft Office Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33148 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Office Elevation of Privilege Vulnerability CVSS: CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to local clients only. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33148
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Elevation of Privilege	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33148	Ruslan Sayfiev and Denis Faiustov

CVE-2023-33149 - Microsoft Office Graphics Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33149 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Office Graphics Remote Code Execution Vulnerability CVSS: CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required None User Interaction Required Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: Is the Preview Pane an attack vector for this vulnerability? Yes, the Preview Pane is an attack vector. There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software? Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? An attacker must send the user a malicious file and convince them to open it. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33149
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2013 RT Service Pack 1	5002400 (Security Update) 5001952 (Security Update)	Important	Remote Code Execution	5002279 4464542	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (32-bit editions)	5002400 (Security Update) 5001952 (Security Update)	Important	Remote Code Execution	5002279 4464542	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (64-bit editions)	5002400 (Security Update) 5001952 (Security Update)	Important	Remote Code Execution	5002279 4464542	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2016 (32-bit edition)	5002419 (Security Update) 4493154 (Security Update)	Important	Remote Code Execution	5002288 4011628	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2016 (64-bit edition)	5002419 (Security Update) 4493154 (Security Update)	Important	Remote Code Execution	5002288 4011628	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for Mac	Release Notes (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.75.23070901	Maybe	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC for Mac 2021	Release Notes (Security Update)	Important	Remote Code Execution	None	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.75.23070901	Maybe	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33149	willJ of vulnerability research institute

CVE-2023-33150 - Microsoft Office Security Feature Bypass Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33150 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Office Security Feature Bypass Vulnerability CVSS: CVSS:3.1 Highest BaseScore:9.6/TemporalScore:8.3 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction Required Scope Changed Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires the victim to open a specially crafted file and click through Office Security Prompt(s). An attacker would have no way to force users to open the file., In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. Is the Attachment Preview Pane an attack vector for this vulnerability? Yes. The attachment Preview Pane that is accessed when a user clicks to preview an attached file is an attack vector; however, the email Preview Pane itself is not. What kind of security feature could be bypassed by successfully exploiting this vulnerability? Successful exploitation of this vulnerability would allow an attacker to escape the Office Protected View. Is Application Guard for Office affected by this vulnerability? No. Customers using Application Guard for Office are not affected. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Security Feature Bypass

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33150
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Word 2013 RT Service Pack 1	5002411 (Security Update)	Important	Security Feature Bypass	5002365	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Word 2013 Service Pack 1 (32-bit editions)	5002411 (Security Update)	Important	Security Feature Bypass	5002365	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Word 2013 Service Pack 1 (64-bit editions)	5002411 (Security Update)	Important	Security Feature Bypass	5002365	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Word 2016 (32-bit edition)	5002406 (Security Update)	Important	Security Feature Bypass	5002369	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Word 2016 (64-bit edition)	5002406 (Security Update)	Important	Security Feature Bypass	5002369	Base: 9.6 Temporal: 8.3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33150	Ben Lichtman

CVE-2023-33151 - Microsoft Outlook Spoofing Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33151 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Outlook Spoofing Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction Required Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker. Is the Preview Pane an attack vector for this vulnerability? Yes. The Preview Pane is an attack vector, but additional user interaction is required. What type of information could be disclosed by this vulnerability? Exploiting this vulnerability could allow the disclosure of NetNTLMv2 hashes. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Spoofing

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33151
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Spoofing	None	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Outlook 2013 (32-bit editions)	5002432 (Security Update)	Important	Spoofing	5002382	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Outlook 2013 (64-bit editions)	5002432 (Security Update)	Important	Spoofing	5002382	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Outlook 2013 RT Service Pack 1	5002432 (Security Update)	Important	Spoofing	5002382	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Outlook 2016 (32-bit edition)	5002427 (Security Update)	Important	Spoofing	5002387	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Outlook 2016 (64-bit edition)	5002427 (Security Update)	Important	Spoofing	5002387	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33151	Jordan Hopkins - Rootshell Security

CVE-2023-33152 - Microsoft ActiveX Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33152 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft ActiveX Remote Code Execution Vulnerability CVSS: CVSS:3.1 Highest BaseScore:7.0/TemporalScore:6.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required None User Interaction Required Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted file. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires the victim to open a document and click through multiple warning popups for the attack to be initiated. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33152
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2013 RT Service Pack 1	5002069 (Security Update)	Important	Remote Code Execution	4018332	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (32-bit editions)	5002069 (Security Update)	Important	Remote Code Execution	4018332	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (64-bit editions)	5002069 (Security Update)	Important	Remote Code Execution	4018332	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2016 (32-bit edition)	5002058 (Security Update)	Important	Remote Code Execution	4461476	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2016 (64-bit edition)	5002058 (Security Update)	Important	Remote Code Execution	4461476	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33152	Greg Linares (@Laughing_Mantis)

CVE-2023-33153 - Microsoft Outlook Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33153 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Outlook Remote Code Execution Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.8/TemporalScore:5.9 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction Required Scope Unchanged Confidentiality None Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted file. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33153
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2013 RT Service Pack 1	4464506 (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (32-bit editions)	4464506 (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2013 Service Pack 1 (64-bit editions)	4464506 (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	15.0.5571.1000	Maybe	None
Microsoft Office 2016 (32-bit edition)	4475581 (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2016 (64-bit edition)	4475581 (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	16.0.5404.1000	Maybe	None
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 32-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None
Microsoft Office LTSC 2021 for 64-bit editions	Click to Run (Security Update)	Important	Remote Code Execution	None	Base: 6.8 Temporal: 5.9 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C	https://aka.ms/OfficeSecurityReleases	No	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33153	Greg Linares (@Laughing_Mantis)

CVE-2023-33165 - Microsoft SharePoint Server Security Feature Bypass Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33165 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft SharePoint Server Security Feature Bypass Vulnerability CVSS: CVSS:3.1 Highest BaseScore:4.3/TemporalScore:3.8 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity Low Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability? The attacker who successfully exploits the vulnerability could download files without the access being logged. What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker could bypass the logging of downloaded files. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Security Feature Bypass

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33165
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Microsoft SharePoint Server 2019	5002423 (Security Update)	Important	Security Feature Bypass	5002402	Base: 4.3 Temporal: 3.8 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C	16.0.10400.20008	Maybe	None
Microsoft SharePoint Server Subscription Edition	5002424 (Security Update)	Important	Security Feature Bypass	5002416	Base: 4.3 Temporal: 3.8 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C	16.0.16130.20642	Maybe	None

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33165	Anonymous Anonymous

CVE-2023-33166 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33166 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33166
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33166	Microsoft Offensive Research & Security Engineering. with Microsoft

CVE-2023-33167 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33167 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33167
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33167	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-33168 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33168 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33168
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33168	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-33169 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33169 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33169
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33169	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-33172 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33172 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33172
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33172	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-33173 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33173 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33173
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33173	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-33174 - Windows Cryptographic Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-33174 MITRE NVD Issuing CNA: Microsoft	CVE Title: Windows Cryptographic Information Disclosure Vulnerability CVSS: CVSS:3.1 Highest BaseScore:5.5/TemporalScore:4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33174
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Information Disclosure	5027230	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Information Disclosure	5027230	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Information Disclosure	5027219	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Information Disclosure	5027219	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Information Disclosure	5027223	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Information Disclosure	5027223	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Information Disclosure	5027231	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Information Disclosure	5027231	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Information Disclosure	5027279	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Information Disclosure	5027279	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Information Disclosure	5027279	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Information Disclosure	5027279	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Information Disclosure	5027275	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Information Disclosure	5027275	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Information Disclosure	5027283	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Information Disclosure	5027283	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Information Disclosure	5027271	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Information Disclosure	5027271	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Information Disclosure	5027219	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Information Disclosure	5027219	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Information Disclosure	5027225	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Information Disclosure	5027225	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-33174	ziming zhang with Ant Security Light-Year Lab

CVE-2023-32033 - Microsoft Failover Cluster Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-32033 MITRE NVD Issuing CNA: Microsoft	CVE Title: Microsoft Failover Cluster Remote Code Execution Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.6/TemporalScore:5.8 Base score metrics Attack Vector Network Attack Complexity High Privileges Required High User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires the attacker or targeted user to have specific elevated privileges. Only users with roles “Cluster Admin” and “Cluster Operator” can access this. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32033
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Remote Code Execution	5027279	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Remote Code Execution	5027279	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Remote Code Execution	5027279	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Remote Code Execution	5027279	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Remote Code Execution	5027275	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Remote Code Execution	5027275	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Remote Code Execution	5027283	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Remote Code Execution	5027283	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Remote Code Execution	5027271	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Remote Code Execution	5027271	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Remote Code Execution	5027219	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Remote Code Execution	5027219	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Remote Code Execution	5027222	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Remote Code Execution	5027222	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Remote Code Execution	5027225	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Remote Code Execution	5027225	Base: 6.6 Temporal: 5.8 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-32033	k0shl with Kunlun Lab

CVE-2023-32034 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-32034 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32034
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-32034	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-32035 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-32035 MITRE NVD Issuing CNA: Microsoft	CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32035
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 for 32-bit Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 for x64-based Systems	5028186 (Security Update)	Important	Denial of Service	5027230	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.10240.20048	Yes	None
Windows 10 Version 1607 for 32-bit Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1607 for x64-based Systems	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Denial of Service	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Denial of Service	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Denial of Service	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows Server 2008 for 32-bit Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5028222 (Monthly Rollup) 5028226 (Security Only)	Important	Denial of Service	5027279	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.0.6003.22175	Yes	5028222 5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5028240 (Monthly Rollup) 5028224 (Security Only)	Important	Denial of Service	5027275	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.1.7601.26623	Yes	5028240 5028224
Windows Server 2012	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 (Server Core installation)	5028232 (Monthly Rollup) 5028233 (Security Only)	Important	Denial of Service	5027283	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.2.9200.24374	Yes	None
Windows Server 2012 R2	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2012 R2 (Server Core installation)	5028228 (Monthly Rollup) 5028223 (Security Only)	Important	Denial of Service	5027271	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	6.3.9600.21063 6.3.9600.21075	Yes	None
Windows Server 2016	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2016 (Server Core installation)	5028169 (Security Update)	Important	Denial of Service	5027219	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.14393.6085	Yes	None
Windows Server 2019	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2019 (Server Core installation)	5028168 (Security Update)	Important	Denial of Service	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows Server 2022	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171
Windows Server 2022 (Server Core installation)	5028171 (Security Update)	Important	Denial of Service	5027225	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	10.0.20348.1850	Yes	5028171

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-32035	Microsoft Offensive Research & Security Engineering with Microsoft

CVE-2023-32037 - Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-32037 MITRE NVD Issuing CNA: Microsoft	CVE Title: Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability CVSS: CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7 Base score metrics Attack Vector Adjacent Attack Complexity Low Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed Executive Summary: None FAQ: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability? This attack is limited to systems connected to the same network segment as the attacker. The attack cannot be performed across multiple networks (for example, a WAN) and would be limited to systems on the same network switch or virtual network. Mitigations: None Workarounds: None Revision: 1.0    11-Jul-23     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32037
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Fixed Build	Restart Required	Known Issue
Windows 10 Version 1809 for 32-bit Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for ARM64-based Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 1809 for x64-based Systems	5028168 (Security Update)	Important	Information Disclosure	5027222	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.17763.4645	Yes	5028168
Windows 10 Version 21H2 for 32-bit Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for ARM64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 21H2 for x64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19041.3208	Yes	5028166
Windows 10 Version 22H2 for 32-bit Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for ARM64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 10 Version 22H2 for x64-based Systems	5028166 (Security Update)	Important	Information Disclosure	5027215	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.19045.3208	Yes	5028166
Windows 11 version 21H2 for ARM64-based Systems	5028182 (Security Update)	Important	Information Disclosure	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 version 21H2 for x64-based Systems	5028182 (Security Update)	Important	Information Disclosure	5027223	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22000.2176	Yes	5028182
Windows 11 Version 22H2 for ARM64-based Systems	5028185 (Security Update)	Important	Information Disclosure	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22621.1992	Yes	5028185
Windows 11 Version 22H2 for x64-based Systems	5028185 (Security Update)	Important	Information Disclosure	5027231	Base: 6.5 Temporal: 5.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	10.0.22621.1992	Yes