NewsCompaniesFlawsGuides
Get the app

CVE-2023-36563

From Exploited flaws, HARD’s guide to the flaws being used in attacks · Checked
This article is about a flaw in Microsoft WordPad. For every flaw being used in attacks, see Exploited flaws; for Microsoft’s, see Microsoft flaws being used in attacks.

CVE-2023-36563 is a security flaw in Microsoft WordPad, a part of Windows, Microsoft’s operating system. Attackers can read information from Microsoft WordPad that should be private. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 10 Oct 2023.[1]

Microsoft WordPad is in things households have, such as phones, computers, browsers and everyday apps, so the fix matters at home as much as at work. Fixed in version 10.0.17763.4974, 10.0.20348.2031, 10.0.22000.2538 and 10.0.19041.3570 and others.

Description

CISA calls it an information disclosure in Microsoft WordPad. In its words: “Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.”[1]

The underlying weakness is improper input validation (CWE-20), in MITRE’s list of common software weaknesses.[2]

It scores 5.5 out of 10 on the Common Vulnerability Scoring System, which rates it medium, scored by NVD using CVSS 3.1.[2]

Affected versions

NVD’s record lists these fixed versions: in each line, everything before the version shown is affected.[2]

ProductFixed in
Windows 10 Version 180910.0.17763.4974
Windows Server 201910.0.17763.4974
Windows Server 2019 (Server Core installation)10.0.17763.4974
Windows Server 202210.0.20348.2031
Windows 11 version 21H210.0.22000.2538
Windows 10 Version 21H210.0.19041.3570
Windows 11 version 22H210.0.22621.2428
Windows 10 Version 22H210.0.19045.3570

Every device with Microsoft WordPad needs the update.

Exploitation

CISA added it to its catalog of known exploited vulnerabilities on 10 Oct 2023, within a day of it being made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 31 Oct 2023 to fix it.[1]

FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 20%. That’s in the top 3% of the flaws it scores.[4]

CISA assesses it as not automatable: each attack takes some work.

CISA doesn’t say who was attacked, or how.

Fix

Microsoft has published a fix or advice.[3] CISA’s required action: “Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.”[1]

  1. Update Microsoft WordPad now.On Windows: Settings, Windows Update, Check for updates, then restart. Office updates come the same way, or from any Office app: File, Account, Update Options. Then turn on automatic updates, so the next fix arrives on its own.
  2. Check you’re on 10.0.17763.4974 or later.Fixed in version 10.0.17763.4974, 10.0.20348.2031, 10.0.22000.2538 and 10.0.19041.3570 and others. Anything older is what attackers are going after.
  3. If there’s no update, stop using it.CISA’s advice when a flaw being used in attacks has no fix is to stop using the product until it does.

Timeline

DateEvent
The flaw is made public in the National Vulnerability Database, with a severity score of 5.5.[2]
CISA adds it to its catalog of flaws known to be used in attacks.[1]
CISA’s deadline for US government agencies to fix it.[1]
FIRST puts the odds of it being used in attacks in the next 30 days at 20%.[4]

See also

Other Microsoft flaws

  • CVE-2026-96951, Microsoft Windows: command injection ·
  • CVE-2026-65660, Microsoft SharePoint: code injection ·
  • CVE-2026-85880, Microsoft Windows: heap-based buffer overflow ·
  • CVE-2026-81963, Microsoft Windows: link following ·
  • CVE-2019-1068, Microsoft SQL Server: remote code execution ·

Other improper input validation flaws

  • CVE-2026-93952, Arista VeloCloud Orchestrator: improper input validation ·
  • CVE-2026-12569, PTC Windchill and FlexPLM: improper input validation ·
  • CVE-2026-34910, Ubiquiti UniFi OS: improper input validation ·
  • CVE-2026-6973, Ivanti Endpoint Manager Mobile (EPMM): improper input validation ·
  • CVE-2026-34197, Apache ActiveMQ: improper input validation ·

Added the same day

  • CVE-2023-44487, IETF HTTP/2: rapid reset attack ·
  • CVE-2023-41763, Microsoft Skype for Business: privilege escalation ·
  • CVE-2023-21608, Adobe Acrobat and Reader: use-after-free ·
  • CVE-2023-20109, Cisco IOS and IOS XE: group encrypted transport VPN out-of-bounds write ·

Every Microsoft flaw on CISA’s list · Everything added in October 2023

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Microsoft WordPad Information Disclosure Vulnerability”. Known Exploited Vulnerabilities Catalog, added 10 Oct 2023.
  2. ^ National Institute of Standards and Technology. “CVE-2023-36563 Detail”. National Vulnerability Database, published 10 Oct 2023.
  3. ^ Microsoft. Advisories and fixes: msrc.microsoft.com, msrc.microsoft.com.
  4. ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.203, percentile 97.5, 31 Oct 2026.
  5. CVE Program. “CVE-2023-36563”. The official CVE record.

This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.