Microsoft WordPad Information Disclosure and NTLM Hash Leak Vulnerability (CVE-2023-36563) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft WordPad application on Windows operating systems
Attackers can force the system to leak NTLM credentials (hashes) by inducing users to open a specially crafted document, enabling offline brute-force or NTLM relay attacks
Apply the official Microsoft cumulative security updates, block outbound NTLM traffic, and restrict outbound SMB connections
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the latest cumulative security updates provided by Microsoft. You can verify the installation of the security updates or force Windows Update using PowerShell.
# Check if the specific cumulative update (e.g., KB5031356 or KB5031354) is installed
Get-HotFix | Where-Object { $_.HotFixID -eq 'KB5031356' -or $_.HotFixID -eq 'KB5031354' }
# Force Windows Update installation using the PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block outbound SMB traffic (TCP Port 445) at the network perimeter or host firewall to prevent NTLM credential leakage. Additionally, restrict outbound NTLM traffic via Group Policy or Registry.
# Create a Windows Firewall rule to block outbound SMB traffic (Port 445)
New-NetFirewallRule -DisplayName 'Block Outbound SMB (Prevent NTLM Leak)' `
-Direction Outbound `
-LocalPort 445 `
-Protocol TCP `
-Action Block
# Restrict sending NTLM traffic to remote servers (Windows 11 / Server 2022 and above)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' `
-Name 'RestrictSendingNTLMTraffic' `
-Value 2 -Type DWord3. Log Audit & IoC Verification Commands
Audit the system to check the WordPad executable version and inspect Windows Security Event Logs for suspicious outbound NTLM authentication attempts.
# Verify the file version and modification date of WordPad
Get-ItemProperty -Path 'C:\Program Files\Windows NT\Accessories\wordpad.exe' | `
Select-Object -Property VersionInfo, LastWriteTime
# Query Security Event Logs for NTLM authentication events (Event ID 4624)
Get-WinEvent -FilterHashtable @{
LogName='Security';
Id=4624
} -MaxEvents 100 | Where-Object { $_.Message -like '*NTLM*' } | `
Select-Object TimeCreated, Id, Message | Format-ListBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-36563) is an information disclosure vulnerability in Microsoft WordPad caused by improper validation of input data when parsing documents. An attacker can exploit this by crafting a document containing malicious OLE (Object Linking and Embedding) objects or remote resource paths. When WordPad processes the document, it attempts to establish a connection to a remote server, triggering Windows' default authentication mechanism and leaking the user's NTLM credentials to an attacker-controlled server.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious RTF (Rich Text Format) or WordPad-compatible document embedded with a reference to an external SMB share (e.g., '\\attacker-ip\share\image.png') under their control. When a victim opens this document using WordPad, the application automatically initiates an SMB connection to retrieve the resource. During this handshake, Windows automatically transmits the current user's NTLM challenge/response hash. The attacker captures this hash using tools like Responder and can perform offline cracking to recover the plaintext password or execute NTLM relay attacks to move laterally within the network.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog. It serves as a highly effective vector for initial access or lateral movement within enterprise networks. If an attacker successfully captures and cracks the NTLM hash of a high-privileged account (such as a Domain Administrator), it can lead to full domain compromise, ransomware deployment, and severe business disruption.
Official Vendor Advisories & References
Microsoft WordPad Information Disclosure Vulnerability
Frequently Asked SecOps Questions (CVE-2023-36563)
FAQQ1. How critical is CVE-2023-36563 and is it actively exploited in the wild?
CVE-2023-36563 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 20.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-36563?
Primary impacted vendors include microsoft across wordpad, windows. Scope summary: All systems running Microsoft Windows 10, 11, and Windows Server where WordPad is enabled and the October 2023 security updates are not applied
Q3. What temporary mitigations or workarounds exist for CVE-2023-36563 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates, block outbound NTLM traffic, and restrict outbound SMB connections Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-36563
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.