Is CVE-2023-29360 (Microsoft Streaming Service Untrusted Pointer Dereference) being exploited in the wild?

Yes. CISA added CVE-2023-29360 to its Known Exploited Vulnerabilities catalogue on 29 February 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

What the KEV listing means for this CVE

CVE-2023-29360 should be treated as an actively exploited vulnerability, not a theoretical exposure. For a question like this, the practical meaning of the KEV entry is that exposure should be confirmed immediately, and the response should be driven by the exploitation status rather than by severity alone. The relevant response pattern is the same one used for actively exploited vulnerabilities.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog as the authoritative references for remediation timing and any version-specific instructions. If you are trying to decide whether this issue is urgent, the KEV listing is the strongest available signal that it deserves emergency handling in production environments.

Why the vulnerability matters operationally

The underlying flaw is an untrusted pointer dereference in Microsoft Streaming Service, and the practical consequence is privilege escalation to SYSTEM by a local attacker. That means the issue is most dangerous on systems where an attacker already has some foothold, because local exploitation can convert limited access into full control of the host. A vulnerability that changes privilege on the endpoint changes the blast radius of any prior compromise.

This is why KEV-listed privilege-escalation flaws often matter even when they are not remote code execution. An attacker who can run code locally may use the bug to escape a restricted context, disable defenses, or gain the ability to tamper with logs, credentials, or other security material stored on the machine. In a managed environment, that can turn a single compromised user session or service into a broader endpoint takeover.

How to respond if patching is delayed

If you cannot remediate immediately, the practical goal is to reduce the chance that an attacker can reach a vulnerable host and to detect any attempt to use it. That usually means tightening local access, limiting interactive logon paths, and looking for unusual privilege elevation activity on systems where Microsoft Streaming Service is present. It is also sensible to review whether the host already shows signs of compromise before you assume the CVE has not been used.

Where the flaw has been exposed in a real environment, rotation may be needed if the compromised host could have yielded cached credentials, tokens, or other sensitive access material. The decision should be based on exposure, not on whether you have already confirmed the exploit technique. If the machine had access to admin tooling or privileged sessions, treat credential review as part of the response.

Risk and Threat Considerations

KEV placement indicates that this is a live exploitation problem, so the main risk is not just the vulnerability itself but the attacker path it opens after initial access. A local privilege-escalation flaw can be used to deepen persistence, tamper with security tooling, and increase the value of any foothold already gained on the endpoint.

Failure mechanism: An attacker with local execution reaches the vulnerable service, triggers the untrusted pointer dereference, and uses the resulting SYSTEM-level context to expand control over the host.

Impact: The host can be fully compromised, enabling defense evasion, sensitive data access, lateral movement support, and potentially the theft or manipulation of credentials and security state.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Actively exploited flaws demand hardened host configuration and reduced exposure.
Recommendation — Harden affected hosts and remove unnecessary attack surface before exploitation is attempted.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about an actively exploited CVE requiring timely remediation.
	SI-4 — System Monitoring	Active exploitation makes detection of compromise and escalation attempts materially important.
Recommendation — Remediate the vulnerable software promptly and track exceptions until closure. Monitor for exploit indicators, privilege escalation, and post-exploitation activity on affected hosts.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	KEV-driven triage is a vulnerability-management decision with urgent remediation implications.
	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation requires monitoring for suspicious host and network behaviour.
Recommendation — Prioritise KEV-listed vulnerabilities ahead of routine backlog items. Watch affected systems for indicators of exploitation and privilege abuse.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as the trigger for action, not the CVE record alone. Confirm which endpoints actually run the affected Microsoft component, then rank them by privilege, exposure, and business criticality so remediation order reflects blast radius.

What to verify: Check for evidence of earlier compromise before and after patching, especially privilege escalation events, unusual SYSTEM activity, suspicious service changes, and security tooling tampering. If the host had privileged access paths, verify whether any adjacent credentials or sessions should be considered exposed.

Practitioner takeaway: When a CVE is in KEV and enables SYSTEM escalation, the decision is no longer whether to watch it, but how quickly to remove the attack path and confirm the host was not already used.