CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys) — Full Exploitation Chain Without NtQuery*/PreviousMode Shortcuts — Threadlinqs Intelligence
As of 2026-06-24, CVE-2023-36802 (Windows Streaming Service Proxy mskssrv.sys) — Full Exploitation Chain Without NtQuery*/PreviousMode Shortcuts is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1539 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
STAR Labs published a novel exploitation chain for CVE-2023-36802, a type-confusion/use-after-free vulnerability in the Windows Streaming Service Proxy driver (mskssrv.sys), achieving local privilege
CVE-2023-36802 is an Elevation of Privilege vulnerability (CVSS 3.1: 7.8 HIGH, CWE-416 Use-After-Free per Microsoft's advisory, described by STAR Labs as a type-confusion defect) in mskssrv.sys, the kernel-mode driver backing the Microsoft Streaming Service Proxy / Frame Server (NPFS-based media streaming IPC used by the Windows Camera Frame Server). The driver's FSRendezvousServer::FindObject helper accepted both FSContextReg (TypeId=1, 0x78 bytes, pool tag 'CreG', created via IOCTL 0x2F0400/IOCTL_FRAMESERVER_INIT_CONTEXT) and FSStreamReg (TypeId=2, 0x1D8 bytes, pool tag 'SreG', created via IOCTL 0x2F0404/IOCTL_FRAMESERVER_INIT_STREAM) objects without validating which type was actually supplied — specifically, IOCTL_FRAMESERVER_PUBLISH_RX and sibling handlers trusted whatever object type resided in the FsContext2 field. Calling the stream-only handlers PublishTx (0x2F0408), PublishRx (0x2F040C), ConsumeTx (0x2F0410), or ConsumeRx (0x2F0414) against a smaller FSContextReg object caused the driver to interpret it as the much larger FSStreamReg structure, producing out-of-bounds heap read/write. Microsoft's September 2023 patch (KB5030211 for Windows 10, KB5030219/KB5030217 for Windows 11, equivalent Windows Server KBs) renamed FindObject to FindStreamObject and added an explicit TypeId == 2 check, restricting the search exclusively to the StreamList and rejecting FSContextReg objects outright. A related, earlier vulnerability in the same driver, CVE-2023-29360, had been patched in June 2023, underscoring mskssrv.sys as a recurring attack surface. CVE-2023-36802 was exploited in the wild prior to patching, is listed in the CISA KEV catalog (added with an action-due date of 2023-10-03), and was reported to Microsoft by Guanghui Xia and Quan Jin of DBAPPSecurity WeBin Lab. Two public exploitation lineages exist: (1) an original CLFS-based chain (Valentina Palmiotti, IBM X-Force, Oct 2023) that leaks kernel object addresses via NtQuerySystemInformation, corrupts CLFS log-file structures, chains fake object vtables and kernel gadgets, and uses ObfDereferenceObject to zero the current thread's PreviousMode field, then abuses NtReadVirtualMemory/NtWriteVirtualMemory for kernel read/write before copying the SYSTEM token and executing commands with elevated privileges; and (2) the June 2026 STAR Labs chain analyzed here, which deliberately avoids PreviousMode overwrites and NtQuery*-based kernel-address leaks (both now commonly instrumented/detected) in favor of: grooming the non-paged pool with NPFS queue-entry allocations (pool tag 'NpFr', 0x90- and 0x1000-sized LFH buckets) to build a predictable heap layout; using the FSStreamReg::GetStats leak primitive (invoked via the ConsumeTx IOCTL, copying ~32 bytes of queue statistics from object offsets 0x128 [PendingFrames.Count], 0x138 [PendingFrames.Pad3], 0x1a0 [CompletedFrames.Count], 0x1b0 [CompletedFrames.Pad3]) to read adjacent heap object contents including the NpFr2 NPFS queue Flink pointer from adjacent 0x90-sized chunks; triggering an arbitrary-decrement primitive inside FSStreamReg::PublishRx via ObfDereferenceObject on crafted FSFrameMdlEntry structures (MDL pointer fields at offsets 0xA0/0xA8/0xB0/0xB8, control flag Field_C8, requiring the target address+9 to be page-aligned to pass ObDereferenceObject sanity checks) to redirect the Flink pointer into attacker-controlled memory; injecting a fake usermode Dispatch Queue Entry (DQE) into the corrupted NPFS queue (reinforced by an arbitrary-write-of-constant-2 primitive against Field_10 in FSFrameMdl::UnmapPages, achieved by zeroing MDL pointer fields to skip MmUnmapLockedPages) to obtain a stable arbitrary read/write primitive — reads performed via Win32 PeekNamedPipe() against the corrupted pipe to copy controlled kernel addresses into a user buffer, writes performed via a crafted kernel-side IRP whose buffered-I/O completion through IofCompleteRequest() copies attacker data back through SystemBuffer/UserBuffer/IoStatus.Informa
Weaknesses (CWE)
CWE-416, CWE-843
Target sectors: all sectors using windows endpoints, government administration, finance, health, critical infrastructure
Target regions: Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2023-36802, CVE-2023-29360, T1068, T1134, T1211, T1134, T1070, T1562, T1057, T1082, T1106, T1059