CVE-2023-36772
📋 TL;DR
CVE-2023-36772 is a heap-based buffer overflow vulnerability in Microsoft 3D Builder that allows remote code execution when processing specially crafted 3D model files. Attackers can exploit this by tricking users into opening malicious files, potentially gaining the same privileges as the current user. This affects all Windows users with 3D Builder installed.
💻 Affected Systems
- Microsoft 3D Builder
📦 What is this software?
3d Builder by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges, installing malware, stealing data, and establishing persistence.
Likely Case
Attacker gains user-level privileges to execute arbitrary code, potentially leading to data theft, ransomware deployment, or lateral movement.
If Mitigated
Limited impact due to application sandboxing or restricted user privileges, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires user interaction to open malicious 3D file. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security update through Windows Update
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36772
Restart Required: Yes
Instructions:
1. Open Windows Settings. 2. Go to Update & Security > Windows Update. 3. Click 'Check for updates'. 4. Install all available updates. 5. Restart computer if prompted.
🔧 Temporary Workarounds
Uninstall 3D Builder
windowsRemove the vulnerable application entirely
Get-AppxPackage Microsoft.3DBuilder | Remove-AppxPackage
Disable file type associations
windowsPrevent 3D files from automatically opening in 3D Builder
assoc .3mf=
assoc .stl=
assoc .obj=
🧯 If You Can't Patch
- Restrict user privileges to standard user accounts (not administrator)
- Implement application control policies to block 3D Builder execution
🔍 How to Verify
Check if Vulnerable:
Check if 3D Builder is installed and if Windows has pending security updatesCheck Version:
Get-AppxPackage Microsoft.3DBuilder | Select VersionVerify Fix Applied:
Verify Windows Update history shows September 2023 security updates installed📡 Detection & Monitoring
Log Indicators:
- Application crashes of 3D Builder
- Unusual process creation from 3DBuilder.exe
- Suspicious file downloads with 3D extensions
Network Indicators:
- Downloads of 3D model files from untrusted sources
- Outbound connections from 3DBuilder.exe
SIEM Query:
Process Creation where Image contains '3DBuilder.exe' AND ParentImage not in ('explorer.exe', 'cmd.exe')