CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys) — Full Exploitation Chain Without NtQuery*/PreviousMode Shortcuts
CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys) (TL-2026-1539), also tracked as Old Bug, Harder Rules, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-24. It has no confirmed attribution, affects Microsoft Windows 11, references 2 CVEs (CVE-2023-36802, CVE-2023-29360), maps to 15 MITRE ATT&CK techniques (T1003, T1057, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1539
- Threat ID
- TL-2026-1539
- Also known as
- Old Bug, Harder Rules
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors using windows endpoints, government administration, finance, health, critical infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
STAR Labs published a novel exploitation chain for CVE-2023-36802, a type-confusion/use-after-free vulnerability in the Windows Streaming Service Proxy driver (mskssrv.sys), achieving local privilege escalation to SYSTEM on Windows 11 22H2 using heap manipulation and NPFS queue corruption instead of the previously public NtQuery* kernel-leak and PreviousMode-overwrite shortcuts.
How CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys) works
CVE-2023-36802 is an Elevation of Privilege vulnerability (CVSS 3.1: 7.8 HIGH, CWE-416 Use-After-Free per Microsoft's advisory, described by STAR Labs as a type-confusion defect) in mskssrv.sys, the kernel-mode driver backing the Microsoft Streaming Service Proxy / Frame Server (NPFS-based media streaming IPC used by the Windows Camera Frame Server). The driver's FSRendezvousServer::FindObject helper accepted both FSContextReg (TypeId=1, 0x78 bytes, pool tag 'CreG', created via IOCTL 0x2F0400/IOCTL_FRAMESERVER_INIT_CONTEXT) and FSStreamReg (TypeId=2, 0x1D8 bytes, pool tag 'SreG', created via IOCTL 0x2F0404/IOCTL_FRAMESERVER_INIT_STREAM) objects without validating which type was actually supplied — specifically, IOCTL_FRAMESERVER_PUBLISH_RX and sibling handlers trusted whatever object type resided in the FsContext2 field. Calling the stream-only handlers PublishTx (0x2F0408), PublishRx (0x2F040C), ConsumeTx (0x2F0410), or ConsumeRx (0x2F0414) against a smaller FSContextReg object caused the driver to interpret it as the much larger FSStreamReg structure, producing out-of-bounds heap read/write. Microsoft's September 2023 patch (KB5030211 for Windows 10, KB5030219/KB5030217 for Windows 11, equivalent Windows Server KBs) renamed FindObject to FindStreamObject and added an explicit TypeId == 2 check, restricting the search exclusively to the StreamList and rejecting FSContextReg objects outright. A related, earlier vulnerability in the same driver, CVE-2023-29360, had been patched in June 2023, underscoring mskssrv.sys as a recurring attack surface. CVE-2023-36802 was exploited in the wild prior to patching, is listed in the CISA KEV catalog (added with an action-due date of 2023-10-03), and was reported to Microsoft by Guanghui Xia and Quan Jin of DBAPPSecurity WeBin Lab. Two public exploitation lineages exist: (1) an original CLFS-based chain (Valentina Palmiotti, IBM X-Force, Oct 2023) that leaks kernel object addresses via NtQuerySystemInformation, corrupts CLFS log-file structures, chains fake object vtables and kernel gadgets, and uses ObfDereferenceObject to zero the current thread's PreviousMode field, then abuses NtReadVirtualMemory/NtWriteVirtualMemory for kernel read/write before copying the SYSTEM token and executing commands with elevated privileges; and (2) the June 2026 STAR Labs chain analyzed here, which deliberately avoids PreviousMode overwrites and NtQuery*-based kernel-address leaks (both now commonly instrumented/detected) in favor of: grooming the non-paged pool with NPFS queue-entry allocations (pool tag 'NpFr', 0x90- and 0x1000-sized LFH buckets) to build a predictable heap layout; using the FSStreamReg::GetStats leak primitive (invoked via the ConsumeTx IOCTL, copying ~32 bytes of queue statistics from object offsets 0x128 [PendingFrames.Count], 0x138 [PendingFrames.Pad3], 0x1a0 [CompletedFrames.Count], 0x1b0 [CompletedFrames.Pad3]) to read adjacent heap object contents including the NpFr2 NPFS queue Flink pointer from adjacent 0x90-sized chunks; triggering an arbitrary-decrement primitive inside FSStreamReg::PublishRx via ObfDereferenceObject on crafted FSFrameMdlEntry structures (MDL pointer fields at offsets 0xA0/0xA8/0xB0/0xB8, control flag Field_C8, requiring the target address+9 to be page-aligned to pass ObDereferenceObject sanity checks) to redirect the Flink pointer into attacker-controlled memory; injecting a fake usermode Dispatch Queue Entry (DQE) into the corrupted NPFS queue (reinforced by an arbitrary-write-of-constant-2 primitive against Field_10 in FSFrameMdl::UnmapPages, achieved by zeroing MDL pointer fields to skip MmUnmapLockedPages) to obtain a stable arbitrary read/write primitive — reads performed via Win32 PeekNamedPipe() against the corrupted pipe to copy controlled kernel addresses into a user buffer, writes performed via a crafted kernel-side IRP whose buffered-I/O completion through IofCompleteRequest() copies attacker data back through SystemBuffer/UserBuffer/IoStatus.Information; walking kernel structures from the leaked IRP (Tail.Overlay.Thread → ETHREAD) and KTHREAD→EPROCESS (offset 0x220) to locate the current process's EPROCESS, then walking ActiveProcessLinks to locate the SYSTEM process (PID 4) EPROCESS; and finally overwriting the current process's Token pointer (_EPROCESS + 0x4b8) with the SYSTEM process's token to complete the privilege escalation. The technique demonstrates that despite Microsoft's patch closing the type-confusion primitive itself, unpatched or legacy builds (Windows 11 22H2 prior to build 22621.2283) remain exploitable via a detection-evasive path that never touches the two artifacts most EDR/kernel-monitoring tooling instruments for this bug class (NtQuerySystemInformation with SystemExtendedHandleInformation / other NtQuery* kernel-leak calls, and PreviousMode field modification), materially raising detection-engineering priority for driver-level IOCTL telemetry, non-paged pool object lifetime/type validation, and NPFS queue-integrity monitoring around mskssrv.sys.
MITRE ATT&CK techniques used in TL-2026-1539
Credential Access
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation
Defense Evasion
T1070 Indicator Removal; T1134 Access Token Manipulation; T1211 Exploitation for Stealth
Impact
Persistence
T1543 Create or Modify System Process
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1592 Gather Victim Host Information
defense-impairment
Affected products and versions in CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
- Microsoft — Windows 11
Vulnerable versions: 21H2; 22H2 build 22621.1848 and earlier
Fixed in: 22H2 build 22621.2283 and later (KB5030219/KB5030217, September 2023 update) - Microsoft — Windows 10
Vulnerable versions: 1809; 21H2; 22H2 (pre-September 2023 update)
Fixed in: KB5030211/KB5030214, September 2023 cumulative update and later - Microsoft — Windows Server
Vulnerable versions: 2019; 2022 (pre-September 2023 update)
Fixed in: September 2023 cumulative update and later
Remediation for CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
Patches
- Apply Microsoft September 2023 security update for CVE-2023-36802 (Windows 11 22H2 to build 22621.2283 or later; KB5030211/KB5030214 for Windows 10; KB5030219/KB5030217 for Windows 11; equivalent September 2023 cumulative updates for Windows Server 2019/2022)
Immediate actions
- Confirm all Windows 10/11 and Windows Server hosts are patched to September 2023 Patch Tuesday builds or later (Windows 11 22H2 build 22621.2283+; Windows 10 KB5030211/KB5030214; Windows 11 KB5030219/KB5030217)
- Audit for any hosts still running Windows 11 22H2 build 22621.1848 or earlier
- Restrict local logon / interactive access on high-value endpoints where patching is delayed
- Enable kernel driver telemetry (ETW) for mskssrv.sys IOCTL activity where available
- Verify the earlier related CVE-2023-29360 patch (June 2023) is also applied to the same driver
Workarounds
- Where patching cannot occur immediately, restrict or disable the Windows Camera Frame Server / Streaming Service where not required for business function
- Apply application control / driver allowlisting to prevent loading of unauthorized kernel drivers that could chain with this primitive
Longer-term hardening
- Deploy EDR/kernel monitoring with hooks on IOCTL dispatch to mskssrv.sys / NPFS-backed named pipe objects, not just NtQuery* call monitoring
- Instrument PreviousMode field integrity checks AND non-paged pool object lifetime/type validation, since this chain bypasses PreviousMode monitoring entirely
- Monitor for anomalous PeekNamedPipe() and buffered-I/O completion (IofCompleteRequest) patterns against NPFS-backed pipes as candidate arbitrary read/write indicators
- Adopt kernel Control Flow Guard (kCFG) and HVCI broadly to raise the cost of vtable/gadget-based exploitation seen in the CLFS-based lineage of this bug
- Track CISA KEV catalog entries for driver EoP bugs and prioritize patch SLAs for KEV-listed CVEs
CVEs associated with CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
CVE-2023-36802, CVE-2023-29360
Weaknesses (CWE) in CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
CWE-416, CWE-843
Timeline of CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
- Microsoft patches CVE-2023-29360, an earlier, related elevation-of-privilege vulnerability in the same mskssrv.sys driver, establishing it as a recurring attack surface.
- Microsoft credits Guanghui Xia and Quan Jin of DBAPPSecurity WeBin Lab with reporting the vulnerability.
- Microsoft discloses and patches CVE-2023-36802 in the September 2023 Patch Tuesday release; vulnerability confirmed as exploited in the wild prior to patch, prompting CISA KEV catalog addition with an action-due date of 2023-10-03.
- SentinelOne and other vulnerability databases publish initial technical summaries characterizing the flaw as a use-after-free (CWE-416) elevation-of-privilege bug in mskssrv.sys.
- CISA KEV catalog remediation due date for CVE-2023-36802 for federal civilian agencies.
- IBM X-Force researcher Valentina Palmiotti publishes a detailed root-cause analysis and the original public exploitation chain, using NtQuerySystemInformation-based kernel address leaks, CLFS log-file corruption, vtable/gadget chaining, and a PreviousMode overwrite via ObfDereferenceObject to gain arbitrary kernel read/write and copy the SYSTEM token.
- Threat intel pipeline flags the STAR Labs writeup for detection-engineering review because the described technique specifically evades the two kernel-leak/PreviousMode monitoring points most commonly instrumented by EDR products for this vulnerability class.
- STAR Labs publishes 'Old Bug, Harder Rules,' presenting a new exploitation chain for the same type-confusion root cause that avoids the previously public NtQuery*-based kernel leak and PreviousMode overwrite techniques, instead using NPFS heap grooming, the GetStats leak primitive, an arbitrary-decrement primitive in PublishRx, an arbitrary-write primitive in FSFrameMdl::UnmapPages, and fake DQE injection into a corrupted NPFS queue (read via PeekNamedPipe, write via IofCompleteRequest buffered-I/O completion) to reach SYSTEM via direct EPROCESS token swap.
Sources cited for CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys)
- Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts
- CVE-2023-36802 - Security Update Guide - Microsoft MSRC
- CVE-2023-36802 Detail - NVD
- CVE-2023-36802: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | 0-days In-the-Wild
- CISA Known Exploited Vulnerabilities Catalog - CVE-2023-36802
- Microsoft Streaming Service Proxy Elevation of Privilege · CVE-2023-36802 · GitHub Advisory Database
- CVE-2023-36802: Windows 10 1809 Privilege Escalation Flaw - SentinelOne Vulnerability Database
- SB2023091251 - Privilege escalation in Microsoft Streaming Service Proxy
- CVE-2023-29360 Detail - NVD (prior mskssrv.sys vulnerability)
More in vulnerability
- BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustion
- Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)
- BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)
- Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV
- Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install
Detection coverage for TL-2026-1539
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1539 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.