Loading vulnerability…
CVE-2023-21674 is a Windows kernel elevation-of-privilege vulnerability in the Advanced Local Procedure Call (ALPC) subsystem. The flaw is a use-after-free condition in NT kernel ALPC message handling involving synchronous request processing. When an ALPC message is sent with the synchronous-request flag through the deferred worker-factory path, the kernel stores a pointer to the sending thread in the message state. If that thread terminates before ALPC cleanup completes, the stored thread pointer can become dangling. Subsequent ALPC cleanup logic later dereferences the freed thread object, creating a kernel use-after-free condition. Public technical analysis ties the vulnerable path to NtWaitForWorkViaWorkerFactory and later cleanup in AlpcpCancelMessage. The issue was observed in active exploitation and has been described as usable for escaping a Chromium sandbox as part of a multi-stage exploit chain.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (POC) exploit for CVE-2023-21674, a Use-After-Free (UAF) vulnerability in the Windows Advanced Local Procedure Call (ALPC) subsystem. The exploit is implemented in a single C++ file (CVE-2023-21674.cpp) and is designed to be run locally on a vulnerable Windows 10 system. The code creates and manipulates ALPC ports, private namespaces, IO completion objects, and worker factories to trigger the UAF condition. The final step involves impersonating a client via NtAlpcImpersonateClientOfPort, which can result in privilege escalation to SYSTEM. The README provides context about the vulnerability, including crash dumps and debugging output, confirming the exploit's effect. No network endpoints are involved; all actions are performed locally via Windows kernel APIs. The repository is structured simply, with the exploit code and a detailed README.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local privilege escalation vulnerability in Microsoft Windows, allowing attackers to gain elevated privileges on a compromised system.
A Windows kernel use-after-free privilege escalation vulnerability mentioned only in related article links.
A Windows kernel use-after-free vulnerability in the NT OS kernel's ALPC handling that can be triggered via NtWaitForWorkViaWorkerFactory using ALPC_MSGFLG_SYNC_REQUEST, enabling Chrome sandbox escape / local privilege escalation scenarios.
A Windows kernel use-after-free local privilege escalation vulnerability referenced only as a related article for the next stage of the exploit chain.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.