CVE-2023-36563

CVE-2023-36563 is a critical information disclosure vulnerability discovered in Microsoft WordPad. The flaw, categorized as a zero-day bug, was one of the twelve vulnerabilities rated as 'Critical' among 104 issues addressed by Microsoft. The vulnerability was exploited actively in the wild, affecting not only Microsoft Windows and Server but also software such as Microsoft Visual Studio, .NET, and ASP.NET Core. Technical details of this vulnerability were publicly disclosed, raising its risk profile. Microsoft responded swiftly to the threat by releasing patches for CVE-2023-36563 along with two other zero-day vulnerabilities: an elevation-of-privilege flaw in Skype for Business (CVE-2023-41763) and a novel DDoS attack technique named “HTTP/2 Rapid Reset” (CVE-2023-44487). These patches were released on the same day that the vulnerabilities were identified, demonstrating a proactive stance in maintaining the security of their software products. In addition to Microsoft's actions, the Cybersecurity & Infrastructure Security Agency (CISA) added both the WordPad and Skype for Business flaws to the Known Exploited Vulnerabilities (KEV) list. This move further highlighted the severity of these exploits and underscored the need for immediate action from all affected parties. Users of the impacted software are strongly advised to apply the provided patches promptly to mitigate potential risks associated with these vulnerabilities.