CVE-2023-29360 is an untrusted pointer dereference vulnerability in Microsoft Streaming Service. CISA added it to the Known Exploited Vulnerabilities catalogue on 29 February 2024, which means attackers have used it in real attacks. Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
What the vulnerability is
CVE-2023-29360 is an untrusted pointer dereference in Microsoft Streaming Service. That class of flaw is dangerous because the program may follow attacker-influenced memory references instead of trusted program state, which can turn a bug into code execution or privilege escalation depending on where the bad pointer is used.
For a local vulnerability, the practical concern is not just that the service crashes, but that an attacker with some foothold on the machine may be able to turn that foothold into higher privileges. The key question for defenders is whether the vulnerable component is present on systems where local access is already possible.
Why untrusted pointer dereference matters
Pointer dereference flaws are memory-safety issues, so the security impact depends on what the dereferenced address controls and what the program does next. In service code, a bad pointer can corrupt control flow, read sensitive memory, or access privileged objects in ways the developer did not intend.
When the affected component runs as a service, the outcome can be more serious than an ordinary application crash because the service may operate with elevated privileges. That is why Microsoft Streaming Service vulnerabilities are especially relevant on endpoints where a local attacker might already have a user context and is trying to reach SYSTEM.
For background on how weakness classes are grouped and why dereference bugs often sit close to privilege escalation paths, see CWE Top 25 Guide.
How organisations assess exposure
Exposure starts with knowing where Microsoft Streaming Service is installed and whether the system is reachable by untrusted local users. Asset inventory, endpoint role, and local access paths matter because this is not a remote internet-facing exploit pattern in the usual sense; it is a local privilege escalation opportunity once a foothold exists.
Teams should verify vulnerable system presence against vendor guidance and authoritative vulnerability records rather than relying on the term alone. The NIST National Vulnerability Database and the CVE Program provide the canonical record trail for the identifier, while vendor advisories carry the version and fix details.
Because CISA placed this CVE in the KEV catalogue, organisations should treat it as actively exploited and prioritise it using their normal vulnerability management process. Vulnerability Management Guide is a useful companion for asset scoping, prioritisation and verification workflows.
Remediation, detection and compromise review
The right response is to apply the vendor fix as soon as operationally possible, then validate that the affected service is no longer exposed on the targeted systems. If patching is delayed, reduce local attack surface by limiting who can log on interactively, tightening admin separation, and watching closely for suspicious local activity around the service.
Detection should look for signs that a local account has tried to escalate privileges, tamper with the service, or chain the bug into broader compromise. After remediation, review the host for follow-on activity because successful exploitation of a local privilege escalation often means the attacker may have already installed persistence, disabled logging, or accessed protected data before the patch landed.
If exploit activity is suspected, review nearby credential material and privileged sessions on the host, because a SYSTEM compromise can expose tokens, service credentials, and other high-value artefacts even when the original bug was not directly about secrets. For broader patterns of exploited weaknesses leading to credential theft and lateral movement, see The State of NHI & AI Agent Breach Report 2026.
Risk and Threat Considerations
This vulnerability matters because local privilege escalation is often the step that turns a limited foothold into full host control. On a compromised endpoint or server, that escalation can let an attacker disable defenses, harvest credentials, and prepare lateral movement.
Failure mechanism: The service dereferences attacker-influenced memory in a privileged context, so the bug can be shaped into unsafe execution or elevation instead of a harmless fault.
Impact: A successful exploit can give the attacker SYSTEM-level control on the affected machine, increasing the chance of persistence, credential access, and follow-on compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | This CVE is a local privilege escalation vulnerability. |
| Recommendation — Map host alerts to T1068 and hunt for privilege-escalation activity on the affected system. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The page centers on a patched exploited software flaw. |
| IA-5 — Authenticator Management | Post-exploitation review should include credential and session material on the host. | |
| Recommendation — Prioritise SI-2 to remediate the vulnerable service and verify installation status. Use IA-5 to rotate exposed credentials and invalidate compromised sessions after suspected abuse. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term is a KEV-listed exploited vulnerability requiring prioritised remediation. |
| Recommendation — Use CIS-7 to inventory, prioritise and verify remediation of affected systems. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | KEV placement makes this a prioritised risk-management decision. |
| Recommendation — Apply GV.RM-01 to triage the CVE as an actively exploited risk across the environment. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a host-level escalation issue, not just a software defect. If a vulnerable service sits on endpoints where users, contractors, or other local actors can run code, the attack path becomes much easier to exploit.
What to watch for: Focus on systems that combine local user access, weak privilege separation, and delayed patch windows. Those conditions raise the likelihood that a local exploit will succeed before defenders notice.
Practitioner takeaway: Prioritise remediation on systems where local access is plausible, then confirm the host was not already used as a stepping stone before closure.
Related resources from NHI Mgmt Group
- CVE-2025-24990 (Microsoft Windows Untrusted Pointer Dereference)
- CVE-2024-35250 (Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability)
- CVE-2023-21529 (Microsoft Exchange Server Deserialization of Untrusted Data)
- CVE-2025-59287 (Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org