CVE-2023-38146

🗓️ 12 Sep 2023 16:58:21Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 568 Views🌐 WEB

Windows Themes Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 31
zdt	Themebleed Windows 11 Themes Arbitrary Code Execution Exploit	8 Jan 202400:00	–	zdt
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft	13 Oct 202315:33	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft	12 Jul 202612:14	–	githubexploit
Information Security Automation	September 2023: VM courses, Bahasa Indonesia, Russian Podcasts, Goodbye Tinkoff, MS Patch Tuesday, Qualys TOP 20, Linux, Forrester, GigaOm, R-Vision VM	30 Sep 202319:31	–	avleonov
BDU FSTEC	The vulnerability of Themes (Windows themes) in Windows operating systems, allowing a hacker to execute arbitrary code	16 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-38146	12 Sep 202320:29	–	circl
CNNVD	Microsoft Windows Themes Security Vulnerability	12 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-38146 Windows Themes Remote Code Execution Vulnerability	12 Sep 202316:58	–	cvelist
hivepro	‘ThemeBleed’ flaw in Windows 11 Enables Code Execution	18 Sep 202307:09	–	hivepro
Microsoft KB	September 12, 2023—KB5030217 (OS Build 22000.2416)	12 Sep 202307:00	–	mskb

NVD

Vulners

CNA

Node

microsoft windows_11_21h2Range<10.0.22000.2416

microsoft windows_11_22h2Range<10.0.22621.2275

[
  {
    "vendor": "Microsoft",
    "product": "Windows 11 version 21H2",
    "platforms": [
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.22000.2416",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 11 version 22H2",
    "platforms": [
      "ARM64-based Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.22621.0",
        "lessThan": "10.0.22621.2283",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38146
packetstormsecurity	www.packetstormsecurity.com/files/176391/Themebleed-Windows-11-Themes-Arbitrary-Code-Execution.html

Parameter	Position	Path	Description	CWE
#{@file_name}_vrf.dll	path	\\#{datastore['SRVHOST']}\\#{@share}\\#{@file_name}_vrf.dll	TOCTOU between DLL read and execution via SMB UNC path delivering a signed DLL with a mismatched payload.	CWE-367
#{@share}	path	\\#{datastore['SRVHOST']}\\#{@share}\\#{@file_name}	Theme loads an msstyles file from an SMB UNC path referenced by the theme, enabling control over the payload via SMB share.	CWE-367
#{@file_name}	path	\\#{datastore['SRVHOST']}\\#{@share}\\#{@file_name}	Theme loads an msstyles file from an SMB UNC path referenced by the theme, enabling control over the payload via SMB share.	CWE-367
PACKTHEM_VERSION/0/0	nested	/PACKTHEM_VERSION/0/0	Access to the PACKTHEM_VERSION resource inside the STYLE_FILE used to determine version (999) for TOCTOU exploitation.	CWE-367

17 Jun 2026 06:09Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.37381

CWE-367