Threat reportVulnerabilityTL-2026-4942

CVE-2023-36802 mskssrv.sys Type Confusion LPE - Public Exploitation Write-up (StarLabs)

highPATCHED

CVE-2023-36802 mskssrv.sys Type Confusion LPE (TL-2026-4942) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-11-01. It has no confirmed attribution, affects Microsoft Windows 11, references 1 CVE (CVE-2023-36802), maps to 6 MITRE ATT&CK techniques (T1082, T1106, T1134), and is covered by 9 detection rules and 4 indicators of compromise.

CVSS
7.8/10High
CVEs
1Referenced vulnerabilities
Techniques
6MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
4Indicators of compromise

Key facts for TL-2026-4942

Threat ID
TL-2026-4942
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, technology, finance, health, criticalinfrastructure, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
4

Malware and tooling in CVE-2023-36802 mskssrv.sys Type Confusion LPE

Malware and tooling: Windows10

How CVE-2023-36802 mskssrv.sys Type Confusion LPE works

STAR Labs SG published a technical write-up (2026-06-24) detailing full exploitation of CVE-2023-36802, a type-confusion vulnerability in the Microsoft Streaming Service Proxy kernel driver (mskssrv.sys) affecting Windows 11 22H2 builds prior to 22621.2283. CVE-2023-36802 was originally disclosed and patched in Microsoft's September 2023 Patch Tuesday and was added to CISA's Known Exploited Vulnerabilities catalog on the same day as actively exploited. The new write-up provides C trigger code and a modernized exploitation chain (heap grooming, NPFS queue corruption, arbitrary read/write, token theft) that deliberately avoids previously-documented shortcuts.

CVE-2023-36802 is a type-confusion vulnerability (tracked by NVD under CWE-416, Use-After-Free) in `mskssrv.sys`, the kernel-mode Microsoft Streaming Service Proxy driver used by the legacy Media Foundation / DirectShow streaming stack on Windows. The root cause lies in `FSRendezvousServer::FindObject()`, which looked up kernel objects across two internal object lists -- `FSContextReg` (TypeId=1, allocated with pool tag `CreG`, 0x78 bytes) and `FSStreamReg` (TypeId=2, pool tag `SreG`, 0x1D8 bytes) -- without validating that the returned object actually matched the caller-expected type. A low-privileged, unauthenticated-to-the-driver local caller could register a small `FSContextReg` object and then invoke stream-handling IOCTLs that treat it as the much larger `FSStreamReg` structure, producing an out-of-bounds read/write primitive rooted in the size mismatch (0x78 vs 0x1D8 bytes).

The vulnerability was originally disclosed and patched during Microsoft's September 2023 Patch Tuesday (KB5030211, KB5030214, KB5030217, KB5030219), was independently credited to IBM X-Force, and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog the same day the advisory was published, indicating confirmed in-the-wild exploitation at disclosure. Microsoft's fix renamed the vulnerable lookup function to `FindStreamObject` and added an explicit `TypeId == 2` check before treating a looked-up object as a stream registration.

On 2026-06-24, STAR Labs SG (researcher Nguyễn Đức Hiếu, @peter_clowncs, mentored by Dang Nguyen, @MochiNishimiya) published "Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts," a deep technical retrospective explicitly built to avoid two common post-patch crutches: `NtQuerySystemInformation()`-style kernel-address disclosure, and abuse of the `PreviousMode` field for arbitrary kernel read/write. The write-up documents, with C trigger code, a full modern exploitation chain against vulnerable build 22621.1848 (patched in 22621.2283): triggering the type confusion via a sequence of custom IOCTLs against the driver's device interface; leaking adjacent heap contents through `FSStreamReg::GetStats()` to recover a Named Pipe File System (NPFS) `Flink` pointer; grooming the Low Fragmentation Heap by spraying NPFS objects and `CreG`-tagged allocations (using `CancelIoEx()` to unlink and realign queue entries); corrupting the leaked pointer via an arbitrary-decrement primitive reached through `FSStreamReg::PublishRx()` calling `ObfDereferenceObject()` (an earlier arbitrary-write path through `FSFrameMdl::UnmapPages()` is described as unreliable and abandoned); redirecting a corrupted NPFS Data Queue Entry into attacker-controlled memory; using `PeekNamedPipe()` to obtain an arbitrary kernel read; pivoting through a leaked `ETHREAD`/`EPROCESS` pair to obtain an arbitrary kernel write via buffered I/O completion (`IofCompleteRequest()`); and finally walking `_EPROCESS.ActiveProcessLinks` to locate the SYSTEM process (PID 4) and overwrite the calling process's token pointer, yielding full `NT AUTHORITY\SYSTEM` privileges from a standard user context.

Because the underlying CVE is already patched (since September 2023) and the new publication is a research/educational retrospective rather than evidence of a fresh campaign, this threat is tracked for defenders as public, reusable exploitation tradecraft against any still-unpatched Windows 10/11 or Windows Server host, and as a reference chain (type confusion -> heap grooming -> NPFS corruption -> arbitrary R/W -> token theft) that is broadly reusable against other Windows kernel object-confusion bugs.

MITRE ATT&CK techniques used in TL-2026-4942

Discovery

T1082 System Information Discovery

Execution

T1106 Native API

Privilege Escalation

T1134 Access Token Manipulation

Defense Evasion

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Affected products and versions in CVE-2023-36802 mskssrv.sys Type Confusion LPE

  • Microsoft — Windows 11
    Vulnerable versions: 22H2 build 22621.1848
    Fixed in: 22H2 build 22621.2283 (KB5030214)
  • Microsoft — Windows 10
    Vulnerable versions: Version 1809; Version 22H2
    Fixed in: 10.0.17763.4851 (KB5030211); 22H2 (KB5030219)
  • Microsoft — Windows Server 2019
    Vulnerable versions: pre-September 2023 builds
    Fixed in: 10.0.17763.4851 (KB5030211)
  • Microsoft — Windows Server 2022
    Vulnerable versions: pre-September 2023 builds
    Fixed in: 10.0.20348.1970 (KB5030217)

Remediation for CVE-2023-36802 mskssrv.sys Type Confusion LPE

Patches

  • KB5030211 (Windows Server 2019 / Windows 10 1809) - fixed build 10.0.17763.4851
  • KB5030214 (Windows 11 22H2) - fixed build 10.0.22621.2283
  • KB5030217 (Windows Server 2022) - fixed build 10.0.20348.1970
  • KB5030219 (Windows 10 22H2)

Immediate actions

  • Verify all Windows 10, Windows 11, and Windows Server hosts have the September 2023 security updates (KB5030211, KB5030214, KB5030217, KB5030219) or later applied.
  • Confirm Windows 11 22H2 systems are at build 22621.2283 or later.
  • Prioritize patching for CISA Known Exploited Vulnerabilities (KEV) compliance; this CVE's federal remediation deadline (2023-10-03) has already passed and any unpatched host should be treated as overdue-critical.
  • Hunt for anomalous DeviceIoControl activity against the Microsoft Streaming Service Proxy device interface and unexpected NPFS/named-pipe queue manipulation preceding SYSTEM-level token changes.

Workarounds

  • No official workaround beyond applying the patch is documented by Microsoft; where patching is delayed, restrict local logon/interactive access on affected endpoints to trusted users only.

Longer-term hardening

  • Disable or restrict access to legacy Media Foundation / DirectShow / Microsoft Streaming Service Proxy kernel driver interfaces on systems that do not require legacy streaming functionality.
  • Deploy EDR/kernel-callback based detection for anomalous token-handle duplication and process token swaps to SYSTEM from low-integrity processes.
  • Maintain a rapid patch-validation pipeline for KEV-listed local privilege escalation CVEs given their reliable weaponization against unpatched endpoints.
  • Apply the principle of least privilege and local admin restriction to reduce the value of any single LPE primitive.

CVEs associated with CVE-2023-36802 mskssrv.sys Type Confusion LPE

CVE-2023-36802

Weaknesses (CWE) in CVE-2023-36802 mskssrv.sys Type Confusion LPE

CWE-416

Timeline of CVE-2023-36802 mskssrv.sys Type Confusion LPE

  • CISA adds CVE-2023-36802 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
  • Microsoft releases fixes for affected Windows 10, Windows 11, and Windows Server builds (KB5030211, KB5030214, KB5030217, KB5030219), renaming the vulnerable FSRendezvousServer::FindObject lookup to FindStreamObject and adding a TypeId==2 validation check.
  • CVE-2023-36802 publicly disclosed by Microsoft as part of September 2023 Patch Tuesday; MSRC notes the vulnerability had already been exploited in the wild at time of disclosure.
  • CISA Binding Operational Directive 22-01 remediation deadline for federal civilian executive branch agencies to patch CVE-2023-36802.
  • Write-up documents a novel exploitation path (arbitrary-decrement primitive via ObfDereferenceObject plus NPFS Data Queue Entry corruption) that avoids NtQuerySystemInformation-based KASLR leaks and PreviousMode abuse, both common post-patch exploitation shortcuts.
  • STAR Labs SG publishes "Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts," including C trigger code and a full modern exploitation chain for the patched vulnerability.

Sources cited for CVE-2023-36802 mskssrv.sys Type Confusion LPE

Detection coverage for TL-2026-4942

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4942 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
4 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats