# CVE-2023-36802 mskssrv.sys Type Confusion LPE - Public Exploitation Write-up (StarLabs)

> STAR Labs SG published a technical write-up (2026-06-24) detailing full exploitation of CVE-2023-36802, a type-confusion vulnerability in the Microsoft Streaming Service Proxy kernel driver (mskssrv.sys) affecting Windows 11 22H2 builds prior to 22621.2283. CVE-2023-36802 was originally disclosed and patched in Microsoft's September 2023 Patch Tuesday and was added to CISA's Known Exploited Vulnerabilities catalog on the same day as actively exploited. The new write-up provides C trigger code and a modernized exploitation chain (heap grooming, NPFS queue corruption, arbitrary read/write, token theft) that deliberately avoids previously-documented shortcuts.

- **Published:** 2026-11-01T00:57:40Z
- **Last reviewed:** 2026-11-01T00:57:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4942
- **ID:** TL-2026-4942
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-36802

## Description

CVE-2023-36802 is a type-confusion vulnerability (tracked by NVD under CWE-416, Use-After-Free) in `mskssrv.sys`, the kernel-mode Microsoft Streaming Service Proxy driver used by the legacy Media Foundation / DirectShow streaming stack on Windows. The root cause lies in `FSRendezvousServer::FindObject()`, which looked up kernel objects across two internal object lists -- `FSContextReg` (TypeId=1, allocated with pool tag `CreG`, 0x78 bytes) and `FSStreamReg` (TypeId=2, pool tag `SreG`, 0x1D8 bytes) -- without validating that the returned object actually matched the caller-expected type. A low-privileged, unauthenticated-to-the-driver local caller could register a small `FSContextReg` object and then invoke stream-handling IOCTLs that treat it as the much larger `FSStreamReg` structure, producing an out-of-bounds read/write primitive rooted in the size mismatch (0x78 vs 0x1D8 bytes).

The vulnerability was originally disclosed and patched during Microsoft's September 2023 Patch Tuesday (KB5030211, KB5030214, KB5030217, KB5030219), was independently credited to IBM X-Force, and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog the same day the advisory was published, indicating confirmed in-the-wild exploitation at disclosure. Microsoft's fix renamed the vulnerable lookup function to `FindStreamObject` and added an explicit `TypeId == 2` check before treating a looked-up object as a stream registration.

On 2026-06-24, STAR Labs SG (researcher Nguyễn Đức Hiếu, @peter_clowncs, mentored by Dang Nguyen, @MochiNishimiya) published "Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts," a deep technical retrospective explicitly built to avoid two common post-patch crutches: `NtQuerySystemInformation()`-style kernel-address disclosure, and abuse of the `PreviousMode` field for arbitrary kernel read/write. The write-up documents, with C trigger code, a full modern exploitation chain against vulnerable build 22621.1848 (patched in 22621.2283): triggering the type confusion via a sequence of custom IOCTLs against the driver's device interface; leaking adjacent heap contents through `FSStreamReg::GetStats()` to recover a Named Pipe File System (NPFS) `Flink` pointer; grooming the Low Fragmentation Heap by spraying NPFS objects and `CreG`-tagged allocations (using `CancelIoEx()` to unlink and realign queue entries); corrupting the leaked pointer via an arbitrary-decrement primitive reached through `FSStreamReg::PublishRx()` calling `ObfDereferenceObject()` (an earlier arbitrary-write path through `FSFrameMdl::UnmapPages()` is described as unreliable and abandoned); redirecting a corrupted NPFS Data Queue Entry into attacker-controlled memory; using `PeekNamedPipe()` to obtain an arbitrary kernel read; pivoting through a leaked `ETHREAD`/`EPROCESS` pair to obtain an arbitrary kernel write via buffered I/O completion (`IofCompleteRequest()`); and finally walking `_EPROCESS.ActiveProcessLinks` to locate the SYSTEM process (PID 4) and overwrite the calling process's token pointer, yielding full `NT AUTHORITY\SYSTEM` privileges from a standard user context.

Because the underlying CVE is already patched (since September 2023) and the new publication is a research/educational retrospective rather than evidence of a fresh campaign, this threat is tracked for defenders as public, reusable exploitation tradecraft against any still-unpatched Windows 10/11 or Windows Server host, and as a reference chain (type confusion -> heap grooming -> NPFS corruption -> arbitrary R/W -> token theft) that is broadly reusable against other Windows kernel object-confusion bugs.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1134 Access Token Manipulation
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1106 Native API
- T1082 System Information Discovery

## Sources

- [Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts](https://starlabs.sg/blog/2026/06-old-bug-harder-rules-exploiting-cve-2023-36802-without-the-usual-shortcuts/)
- [CVE-2023-36802 - Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802)
- [NVD - CVE-2023-36802 Detail](https://nvd.nist.gov/vuln/detail/CVE-2023-36802)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2023-36802](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36802)
- [Microsoft September 2023 Patch Tuesday](https://isc.sans.edu/diary/30214)
- [CERT-EU Security Advisory 2023-064 - Microsoft September 2023 Patch Tuesday](https://cert.europa.eu/publications/security-advisories/2023-064/)
- [STAR Labs Patch Tuesday Analysis - CVE-2023-36802 (2023-09)](https://onlyfm252.starlabs.sg/patch-tuesday/2023-09/cve-2023-36802/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4942