CVE-2023-23402 — Windows Media Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

Windows Media Remote Code Execution Vulnerability

Published Mar 14, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.60%

Description

Windows Media Remote Code Execution Vulnerability

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
n/a
- Version
  10.0.10240.0
  Status
  affected
  Constraints
  <10.0.10240.19805
Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5786
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.17763.4131
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.4131
Vendor Microsoft Product Windows 10 Version 20H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19042.2728
Vendor Microsoft Product Windows 10 Version 21H2 Default
n/a
- Version
  10.0.19043.0
  Status
  affected
  Constraints
  <10.0.19044.2728
Vendor Microsoft Product Windows 10 Version 22H2 Default
n/a
- Version
  10.0.19045.0
  Status
  affected
  Constraints
  <10.0.19045.2728
Vendor Microsoft Product Windows 11 version 21H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.22000.1696
Vendor Microsoft Product Windows 11 version 22H2 Default
n/a
- Version
  10.0.22621.0
  Status
  affected
  Constraints
  <10.0.22621.1413
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 Default
n/a
- Version
  6.1.7601.0
  Status
  affected
  Constraints
  <6.1.7601.26415
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 (Server Core installation) Default
n/a
- Version
  6.1.7601.0
  Status
  affected
  Constraints
  <6.1.7601.26415
Vendor Microsoft Product Windows Server 2012 Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.24168
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.24168
Vendor Microsoft Product Windows Server 2012 R2 Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.20865
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.20865
Vendor Microsoft Product Windows Server 2016 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5786
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5786
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.4131
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.4131
Vendor Microsoft Product Windows Server 2022 Default
n/a
- Version
  10.0.20348.0
  Status
  affected
  Constraints
  <10.0.20348.1607

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1507

n/a

Version	Status	Constraints
10.0.10240.0	affected	<10.0.10240.19805

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5786

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.17763.4131
10.0.17763.0	affected	<10.0.17763.4131

Microsoft

Windows 10 Version 20H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19042.2728

Microsoft

Windows 10 Version 21H2

n/a

Version	Status	Constraints
10.0.19043.0	affected	<10.0.19044.2728

Microsoft

Windows 10 Version 22H2

n/a

Version	Status	Constraints
10.0.19045.0	affected	<10.0.19045.2728

Microsoft

Windows 11 version 21H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.22000.1696

Microsoft

Windows 11 version 22H2

n/a

Version	Status	Constraints
10.0.22621.0	affected	<10.0.22621.1413

Microsoft

Windows Server 2008 R2 Service Pack 1

n/a

Version	Status	Constraints
6.1.7601.0	affected	<6.1.7601.26415

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

n/a

Version	Status	Constraints
6.1.7601.0	affected	<6.1.7601.26415

Microsoft

Windows Server 2012

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.24168

Microsoft

Windows Server 2012 (Server Core installation)

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.24168

Microsoft

Windows Server 2012 R2

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.20865

Microsoft

Windows Server 2012 R2 (Server Core installation)

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.20865

Microsoft

Windows Server 2016

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5786

Microsoft

Windows Server 2016 (Server Core installation)

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5786

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.4131

Microsoft

Windows Server 2019 (Server Core installation)

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.4131

Microsoft

Windows Server 2022

n/a

Version	Status	Constraints
10.0.20348.0	affected	<10.0.20348.1607

Remediation

No remediation recorded yet.

Metrics

0.60% 0.00598

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00598

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (21 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.60% (0.00598)	46.67th	v5 (v2026.06.15)
Jun 15, 2026	0.60% (0.00598)	43.77th	v5 (v2026.06.15)
Mar 21, 2026	3.87% (0.03868)	88.11th	v4 (v2025.03.14)
Nov 21, 2025	1.03% (0.01029)	76.64th	v4 (v2025.03.14)
Nov 18, 2025	3.74% (0.03745)	86.85th	v4 (v2025.03.14)
Mar 30, 2025	1.03% (0.01029)	75.31th	v4 (v2025.03.14)
Mar 29, 2025	7.26% (0.07255)	85.75th	v4 (v2025.03.14)
Mar 17, 2025	0.39% (0.00390)	58.02th	v4 (v2025.03.14)
Dec 12, 2024	0.24% (0.00238)	62.70th	v3 (v2023.03.01)
Jul 15, 2024	0.12% (0.00118)	46.29th	v3 (v2023.03.01)
Jul 1, 2024	0.18% (0.00183)	55.80th	v3 (v2023.03.01)
May 10, 2024	0.14% (0.00139)	49.22th	v3 (v2023.03.01)
Apr 27, 2024	0.22% (0.00223)	60.21th	v3 (v2023.03.01)
Apr 15, 2024	0.14% (0.00140)	49.01th	v3 (v2023.03.01)
Apr 2, 2024	0.17% (0.00173)	53.72th	v3 (v2023.03.01)
Jul 8, 2023	0.11% (0.00113)	43.92th	v3 (v2023.03.01)
Jun 29, 2023	0.42% (0.00417)	70.53th	v3 (v2023.03.01)
Jun 21, 2023	0.29% (0.00294)	64.82th	v3 (v2023.03.01)
Jun 16, 2023	0.14% (0.00142)	48.91th	v3 (v2023.03.01)
Mar 21, 2023	0.11% (0.00113)	43.27th	v3 (v2023.03.01)
Mar 15, 2023	0.10% (0.00095)	38.57th	v3 (v2023.03.01)

Weaknesses (1)

CWE-415

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23402
vendor-advisoryPatchVendor Advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23402		vendor-advisoryPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Mar 14, 2023

Updated Jan 1, 2025

Reserved Jan 11, 2023

Link CVE-2023-23402

CISA Vulnrichment

Updated Jul 5, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-23402

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-23402