Microsoft Word Information Disclosure and NTLM Hash Leakage Vulnerability (CVE-2023-36761) Technical Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTBroad range of Microsoft Office products including Microsoft Word 2013, 2016, 2019, 2021, and Microsoft 365 Apps
Attackers can force the victim's system to leak NTLM credentials (hashes) to an external malicious server simply by having the victim select or preview a crafted document in the Preview Pane
Apply the official Microsoft security updates immediately, block outbound SMB (TCP 445) traffic at the perimeter, and restrict outbound NTLM authentication via Group Policy
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official security updates provided by Microsoft. In enterprise environments, deploy updates via WSUS/SCCM. For individual endpoints, you can force Windows Update using PowerShell.
# Install PSWindowsUpdate module and force install the security updates
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB5002490, KB5002457 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, block outbound SMB traffic (TCP port 445) at the host and perimeter firewalls to prevent NTLM hashes from leaving the internal network.
# Block outbound SMB traffic (TCP 445) via Windows Defender Firewall
New-NetFirewallRule -DisplayName 'Block Outbound SMB TCP 445' -Direction Outbound -LocalPort 445 -Protocol TCP -Action Block3. Log Audit & IoC Verification Commands
Monitor outbound SMB connections to external IP addresses and verify if NTLM restriction policies are active on the endpoints.
# Check if Restrict NTLM Outbound traffic policy is enabled via Registry
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'RestrictSendingNTLMTraffic' -ErrorAction SilentlyContinue
# Audit security logs for outbound SMB connection attempts (Event ID 5156)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5156} -MaxEvents 100 | Where-Object {$_.Message -like '*DestPort: 445*'}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2023-36761 is a critical information disclosure vulnerability in Microsoft Word. The root cause lies in improper input validation (CWE-20) when parsing specific document structures. An attacker can craft a malicious Word document containing embedded objects (such as OLE objects or template links) pointing to an external Universal Naming Convention (UNC) path. When the application attempts to render or parse the document, it automatically initiates an outbound connection to the specified remote SMB server without user consent.
2. Exploitation Mechanics & Attack Scenario
An attacker distributes a weaponized Word document via phishing emails or malicious downloads. The document contains a UNC path pointing to an attacker-controlled SMB server (e.g., '\\attacker-ip\share\file'). When the victim previews the document in the Outlook Preview Pane or opens it in Word, the Windows operating system automatically attempts to authenticate against the remote SMB server. During this handshake, the victim's NTLM challenge-response hash is transmitted to the attacker. The attacker can capture this hash using tools like Responder and attempt offline brute-forcing or perform NTLM relay attacks to compromise other internal network resources.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Because exploitation requires minimal user interaction (simply previewing the file is sufficient), it poses a severe threat to enterprise environments. A successful compromise of a domain user's NTLM hash can serve as an initial access vector, leading to lateral movement and potential full Active Directory domain compromise.
Official Vendor Advisories & References
Microsoft Word Information Disclosure Vulnerability
Frequently Asked SecOps Questions (CVE-2023-36761)
FAQQ1. How critical is CVE-2023-36761 and is it actively exploited in the wild?
CVE-2023-36761 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 19.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-36761?
Primary impacted vendors include microsoft across word, office. Scope summary: Microsoft Word 2013 Service Pack 1, Microsoft Word 2016, Microsoft Word 2019, Microsoft Word 2021 LTSC, Microsoft 365 Apps for Enterprise (all update channels)
Q3. What temporary mitigations or workarounds exist for CVE-2023-36761 before patching?
[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB (TCP 445) traffic at the perimeter, and restrict outbound NTLM authentication via Group Policy Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-36761
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Office Word Security Feature Bypass Vulnerability (CVE-2026-21514) Analysis and Mitigation Guide
[Affected Scope] Microsoft Office Word and associated Office suites
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.