HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2023-38170

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Hevc Video Extension
Hevc Video Extensions
Vendor
CVE Published:
8 August 2023

What is CVE-2023-38170?

The HEVC Video Extensions, a product by Microsoft, is exposed to a vulnerability that allows remote code execution. This flaw could enable an attacker to execute arbitrary code on the victim’s machine via manipulated HEVC content. Users are highly recommended to apply necessary security updates to mitigate risks associated with this vulnerability, as it can potentially lead to severe consequences if exploited.

Affected Version(s)

HEVC Video Extension Unknown 1.0.0.0 < 2.0.61931.0

HEVC Video Extensions Unknown 1.0.0 < 2.0.61933.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-38170 : HEVC Video Extensions Remote Code Execution Vulnerability