CVE-2023-36436

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Windows MSHTML Platform Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.4974
Microsoft	Windows 10 Version 1809	>= 10.0.0, < 10.0.17763.4974
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.4974
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.4974
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.2031
Microsoft	Windows 11 version 21H2	>= 10.0.0, < 10.0.22000.2538
Microsoft	Windows 10 Version 21H2	>= 10.0.19043.0, < 10.0.19041.3570
Microsoft	Windows 11 version 22H2	>= 10.0.22621.0, < 10.0.22621.2428
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.3570
Microsoft	Windows 10 Version 1507	>= 10.0.10240.0, < 10.0.10240.20232
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.6351
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.6351
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.6351
Microsoft	Windows Server 2008 Service Pack 2	>= 6.0.6003.0, < 6.0.6003.22317
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	>= 6.0.6003.0, < 6.0.6003.22317
Microsoft	Windows Server 2008 Service Pack 2	>= 6.0.6003.0, < 6.0.6003.22317
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.24523
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.24523
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.21620
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.21620

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36436Patch, Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36436Patch, Vendor Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364378.8Azure DevOps Server Remote Code Execution Vulnerability CVE-2023-364387.5Windows TCP/IP Information Disclosure Vulnerability CVE-2023-364398.0Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2023-36449.8A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability aff CVE-2023-36454.8The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high CVE-2023-364567.3authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwar CVE-2023-364578.81Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craf CVE-2023-364588.81Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craf CVE-2023-364596.1Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and CVE-2023-36467.5On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel p CVE-2023-364609.9Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364617.5Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout o