CVE-2023-29360: Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

CVE-2023-29360 is an untrusted pointer dereference vulnerability in the Microsoft Streaming Service. A local attacker who already has some access on a Windows system can abuse it to escalate privileges and obtain SYSTEM-level rights. That matters because SYSTEM access lets an attacker disable security tools, install persistence, move laterally, or access sensitive data that ordinary user accounts cannot reach. Public detail is limited to the CISA summary and the CWE classification; exact affected builds and exploitation mechanics must be confirmed against the Microsoft advisory.

How it works

The flaw is classified as CWE-822: Untrusted Pointer Dereference. In this class of bug, code trusts a pointer value that an attacker can influence. When the service later dereferences that pointer, the attacker can redirect execution or memory access in a way that elevates privileges. According to the CISA summary, successful abuse of the Microsoft Streaming Service vulnerability allows a local attacker to gain SYSTEM privileges. No public exploit code or detailed call-stack information is supplied in the available facts, so defenders should treat the issue as a classic local privilege-escalation path rather than inventing specific trigger sequences. Confirm the precise conditions against the vendor advisory.

Am I affected? How to find it in your systems

Microsoft Streaming Service is a Windows component typically present on client and server editions that handle media streaming or related kernel-mode functionality. Inventory every Windows host—workstations, servers, virtual machines, and images used in golden-image pipelines. Use your existing asset-management tools, SCCM/ConfigMgr, Intune, or PowerShell queries that enumerate installed Windows components and service status for the streaming service. Because exact version ranges are not listed in the provided facts, compare each host’s build and patch level against the Microsoft security update that addresses CVE-2023-29360; do not assume any particular build is safe without that check.

For detection of possible exploitation, look for unusual local privilege-escalation activity: processes spawning with SYSTEM integrity from non-administrative parents, unexpected service crashes or restarts related to streaming components, and kernel-mode or service-host anomalies recorded in the System and Security event logs. Endpoint detection and response (EDR) telemetry that flags token manipulation or suspicious handle usage can also surface attempts. Absence of these signs does not prove safety; it only means you have not yet observed the activity.

How to remediate

Patch first. Apply the Microsoft security update that remediates CVE-2023-29360 exactly as described in the vendor advisory. After installation, reboot if required and verify the update is present with your patch-management console or Windows Update history. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable; follow that guidance.

Once patched, harden the environment against similar local privilege-escalation classes: enforce least privilege so that users and services run with the minimum rights needed, enable Credential Guard and other Windows security features that protect SYSTEM tokens where supported, and keep kernel-mode components fully updated. Regularly audit local administrator group membership and remove unnecessary accounts.

If you can't patch immediately

Until the vendor update can be deployed, reduce risk with compensating controls. Segment systems that must remain unpatched so that a compromised low-privilege account cannot easily reach high-value assets. Restrict interactive logon and remote desktop access to only those accounts that require it. If the streaming service can be disabled without breaking required business functions, do so after testing; otherwise leave it running but monitor it closely. Virtual patching via host-based intrusion prevention or EDR rules that block known privilege-escalation patterns can buy time, but these are temporary. Increase logging and alerting on process creation, service control manager events, and token elevation so that any exploitation attempt is visible quickly. Discontinue use of the component only if the vendor states no mitigation is available and business impact allows it.

If your data may have been exposed

Actively exploited local privilege-escalation vulnerabilities frequently lead to full system compromise and subsequent data theft or ransomware deployment; the facts state that ransomware use of this CVE is not documented, yet the risk remains. If you suspect a host was compromised before patching, isolate it, collect forensic images, and examine for persistence and data exfiltration. As a further check, you can run a free exposure scan of your email addresses against known breach data to determine whether credentials or personal information have already appeared in public dumps.