CVE-2023-21782
📛 CVE Title
3D Builder Remote Code Execution Vulnerability
Description
3D Builder Remote Code Execution Vulnerability
Overview
- State
- PUBLISHED
- Assigner (CNA)
- microsoft
- CVSS severity
- HIGH
- CVSS score
- 7.8 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C- Effective score
- 7.8 / 10 HIGH source: CNA overview
- MSRC score
- 7.8 / 10 HIGH MS rating: Important · Remote Code Execution
- CWE(s)
-
CWE-122 - Reserved
- 2022-12-16
- Published
- 2023-01-10 08:00 UTC
- Last updated
- 2023-01-11 08:00 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/21xxx/CVE-2023-21782.json
- Linked Threat
- CVE-2023-21782 — 3D Builder Remote Code Execution Vulnerability
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-25949 - Assigner
- microsoft
- Published
- Jan 10, 2023, 12:00:00 AM
- Updated
- Jan 1, 2025, 12:36:13 AM
- EUVD base score (CVSS 3.1)
-
7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - EUVD-reported EPSS
- 3.9000
- Vendors
- Microsoft
- Products
-
3D Builder (20.0.0 <20.0.1)
- Aliases
-
GHSA-gxfr-5f3f-m5rv
ENISA description: 3D Builder Remote Code Execution Vulnerability
EUVD references (1)
Microsoft Security Response Center MSRC
Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:01 UTC (source: CVRF).
- MS severity
- Important
- Impact
- Remote Code Execution
- MS CVSS base score
- 7.8 / 10 (temporal 6.8)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Exploit assessment
- Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;DOS:N/A
- Release
- 2023-Jan
Microsoft remediations / KB articles (1)
- More Information — Vendor Fix / Security Update (fixed build 20.0.1)
Microsoft FAQ (3)
According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send the user a malicious file and convince them to open it.
How do I get the update for a Windows App?
The Microsoft Store will automatically update affected customers.
It is possible for customers to disable automatic updates for the Microsoft Store. The Microsoft Store will not automatically install this update for those customers. You can get the update through the store by following this guide: Get updates for apps and games in Microsoft Store. Be sure to select the tab for the operating system installed on your device to search for updates.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Microsoft | 3D Builder |
20.0.0 (affected)
|
Unknown |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- 3D Builder Remote Code Execution Vulnerability vendor-advisory
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
Remediations (18)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-06-04 11:44 UTC -
web:www.bleepingcomputer.com
CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks.
2026-06-04 11:44 UTC -
web:gemini.google.com
Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.
2026-06-04 11:44 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-06-04 11:44 UTC -
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-06-04 11:44 UTC -
web:www.grammarly.com
Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.
2026-06-04 11:44 UTC -
web:cyberpress.org
Oracle has released its January 2026 Critical Patch Update (CPU), delivering security patches for 337 vulnerabilities across multiple product families. Published through Oracle's Security Alerts portal, the advisory emphasizes the cumulative nature of these patches and strongly recommends immediate deployment across enterprise environments to ...
2026-06-04 11:44 UTC -
web:cybersecuritynews.com
CISA has issued a fresh warning highlighting active exploitation of a critical Oracle WebLogic Server vulnerability, tracked as CVE -2024-21182, adding it to its Known Exploited Vulnerabilities (KEV) catalog on June 1, 2026. The alert underscores the increasing risk posed by exposed enterprise middleware systems, particularly those accessible over network protocols such as T3 and IIOP. The ...
2026-06-04 11:44 UTC -
web:www.howtogeek.com
Here's the list of mitigation solutions available as we go to publication: Ubuntu Red Hat Enterprise Linux SUSE The Red Hat team warns that there may be a "performance impact" for any task that requires Linux kernel cryptograpic features, so you might notice the effects until a patch lets you restore the relevant processes.
2026-05-22 05:46 UTC -
web:app.opencve.io
Explore the latest vulnerabilities and security issues in the CVE database
2026-05-22 05:46 UTC -
web:www.romhacking.net
Add temporary header() Patch file: Apply patch Original ROM: Modified ROM: Patch type: IPS BPS PPF UPS APS RUP Create patch Settings Rom Patcher JS v2.9 by Marc Robledo See on GitHub Donate Language English Français Deutsch Italiano Español Nederlands Svenska Català Valencià Português Brasileiro Russian 日本語 中文（简体） 中文 ...
2026-05-22 05:46 UTC -
web:blog.qualys.com
RedSun is a zero-day LPE in Microsoft Defender with no patch available. Learn how to detect and mitigate it instantly using Qualys VMDR and TruRisk™ Eliminate.
2026-05-22 05:46 UTC -
web:learn.microsoft.com
These release notes provide information about security fixes that are included in updates to Microsoft Office. This information applies to Microsoft 365 Apps for enterprise, Microsoft 365 Apps for business, Office 2019, Office LTSC 2021, Office 2021, Office LTSC 2024, and Office 2024.
2026-05-22 05:46 UTC -
web:patch.moe
Age Verification Are you 18 years or older? YES NO
2026-05-22 05:46 UTC -
web:patchnashville.com
Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.
2026-05-22 05:46 UTC -
web:www.callofduty.com
Make sure you're following @CODUpdates, @Treyarch, @RavenSoftware for critical live communications and track common Live Issues on our Trello Boards. For regular updates about all Call of Duty® related live issues, follow @CODUpdates. For updates about Call of Duty®: Black Ops 7 Multiplayer and Zombies, follow @Treyarch. For regular updates about Call of Duty®: Black Ops 7 Campaign and ...
2026-05-22 05:46 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 05:46 UTC -
web:www.fixferreterias.com
FIX FERRETERÍAS Acerca de nosotros Ubica tu tienda Catálogo Grupo Truper SOPORTE AL CLIENTE Facturación Cotizaciones Preguntas Frecuentes Mis pedidos POLÍTICAS Ventas Devoluciones Garantías Precios Aviso de privacidad
2026-05-22 05:46 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-21782.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:51:51.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "3D Builder Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21782"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "3D Builder",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "20.0.1",
"status": "affected",
"version": "20.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:3d_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "20.0.1",
"versionStartIncluding": "20.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-01-10T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "3D Builder Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T00:36:13.797Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "3D Builder Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21782"
}
],
"title": "3D Builder Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-21782",
"datePublished": "2023-01-10T00:00:00.000Z",
"dateReserved": "2022-12-16T00:00:00.000Z",
"dateUpdated": "2025-01-01T00:36:13.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}