Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability (CVE-2023-36802) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Streaming Service Proxy driver (mskssrv.sys) in Windows 10, Windows 11, and Windows Server families
Local attackers can execute arbitrary code with SYSTEM privileges, leading to full system compromise; actively exploited in the wild
Apply the official Microsoft security patches immediately, or restrict access to the vulnerable driver as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official cumulative security updates provided by Microsoft. You can verify the patch status or force the update installation using the following PowerShell commands.
# Check if the required cumulative update (e.g., KB5030217, KB5030219) is installed
Get-HotFix | Where-Object { $_.HotFixID -match 'KB5030217|KB5030219|KB5030211' }
# Install the Windows Update module and force-install pending security updates
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, you can mitigate the attack vector by restricting access permissions to the vulnerable driver file (mskssrv.sys) for non-administrative users.
# Deny Read and Execute permissions on mskssrv.sys for the local Users group
icacls 'C:\Windows\System32\drivers\mskssrv.sys' /deny 'BUILTIN\Users:(F)'
# Verify the applied ACL permissions
icacls 'C:\Windows\System32\drivers\mskssrv.sys'3. Log Audit & IoC Verification Commands
Verify the file version of the driver to confirm patch status and inspect the Windows Event Logs for any anomalous driver behavior or crashes.
# Retrieve the file and product version of mskssrv.sys
Get-ItemProperty -Path 'C:\Windows\System32\drivers\mskssrv.sys' | Select-Object -ExpandProperty VersionInfo | Format-List ProductVersion, FileVersion
# Query System Event Logs for errors or warnings related to mskssrv
Get-WinEvent -LogName System | Where-Object { $_.Message -like '*mskssrv*' -or $_.ProviderName -like '*mskssrv*' } | Select-Object TimeCreated, Id, LevelDisplayName, Message -First 20Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-36802) is a Use-After-Free (UAF, CWE-416) flaw residing in the Microsoft Streaming Service Proxy driver (mskssrv.sys), which operates within the Windows kernel space. The root cause lies in the driver's improper handling of memory pointers associated with streaming session objects. When processing specific input/output control (IOCTL) requests, the driver fails to properly validate or nullify pointers to memory blocks that have already been deallocated, leading to a use-after-free condition.
2. Exploitation Mechanics & Attack Scenario
A local attacker with low-privilege access can craft and send malicious IOCTL requests to the mskssrv.sys device interface. By manipulating the reference counts of specific kernel objects, the attacker triggers premature memory deallocation. The attacker then grooms the kernel pool memory layout to overwrite the freed memory space with controlled payloads. When the driver subsequently attempts to reference the object, it executes attacker-controlled virtual function tables (vftables), resulting in arbitrary code execution in kernel mode (Ring 0) under the SYSTEM context.
3. Infrastructure & Business Impact
As this vulnerability is cataloged in CISA's Known Exploited Vulnerabilities (KEV), it represents an active and immediate threat. Successful exploitation allows a local attacker to bypass all user-mode security boundaries, disable endpoint detection and response (EDR) agents, dump sensitive credentials, and deploy ransomware or establish persistent backdoors. This poses a severe risk of lateral movement and complete infrastructure compromise.
Official Vendor Advisories & References
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2023-36802)
FAQQ1. How critical is CVE-2023-36802 and is it actively exploited in the wild?
CVE-2023-36802 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 27.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-36802?
Primary impacted vendors include microsoft across windows, microsoft streaming service proxy. Scope summary: Windows 10, Windows 11, and Windows Server 2019/2022 running vulnerable versions of the Microsoft Streaming Service Proxy driver (mskssrv.sys)
Q3. What temporary mitigations or workarounds exist for CVE-2023-36802 before patching?
[Mitigation] Apply the official Microsoft security patches immediately, or restrict access to the vulnerable driver as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-36802
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.