CVE-2023-38140
Status: AnalyzedMedium (5.5)—
Windows Kernel Information Disclosure Vulnerability
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Base score: 5.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.06%
- Percentile among all scored CVEs: 64
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (8)
CWEs
- CWE-908
- NVD-CWE-noinfo
References
Raw JSON (NVD)
Show
{
"id": "CVE-2023-38140",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.4851",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.17763.4851",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.4851",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.4851",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2022",
"versions": [
{
"status": "affected",
"version": "10.0.20348.0",
"lessThan": "10.0.20348.1970",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 version 21H2",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.22000.2416",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems",
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 21H2",
"versions": [
{
"status": "affected",
"version": "10.0.19043.0",
"lessThan": "10.0.19044.3448",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 22H2",
"versions": [
{
"status": "affected",
"version": "10.0.19045.0",
"lessThan": "10.0.19045.3448",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems",
"ARM64-based Systems",
"32-bit Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1607",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.6252",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.6252",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.6252",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
}
]
}
],
"published": "2023-09-12T17:15:16.547",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38140",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secure@microsoft.com"
},
{
"url": "http://packetstormsecurity.com/files/175108/Microsoft-Windows-Kernel-Paged-Pool-Memory-Disclosure.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38140",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-908"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Windows Kernel Information Disclosure Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de Divulgación de Información del Kernel de Windows"
}
],
"lastModified": "2026-06-17T06:09:30.960",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE629A99-48EA-4736-A2AF-BE8AE3C84CB5",
"versionEndExcluding": "10.0.14393.6252"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "405C3661-5BC3-4EFC-9FF0-4C05D6F42A04",
"versionEndExcluding": "10.0.17763.4851"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "139662E6-EF56-4398-AEE8-406B8D4F1BC4",
"versionEndExcluding": "10.0.19044.3448"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36C0F053-7225-4428-A7D5-7FE2E5036E79",
"versionEndExcluding": "10.0.19045.3448"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42BAE974-E011-42BC-BE68-E394DFF2F92D",
"versionEndExcluding": "10.0.22000.2416"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC2A0CE5-C223-434F-9FAF-DCE6BADFA1F6",
"versionEndExcluding": "10.0.14393.6252"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AD4B932-AE40-443F-87A6-7D033E9B48D7",
"versionEndExcluding": "10.0.17763.4851"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3D34BDA-C7E8-4049-937B-34E436B6D6D4",
"versionEndExcluding": "10.0.20348.1970"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}