---
title: "WordPad CVE-2023-36563: Exploited NTLM Hash Leak"
url: https://erroneo.us/security/briefs/wordpad-cve-2023-36563-ntlm-hash-disclosure/
description: "Exploited WordPad zero-day leaked NTLM hashes via a crafted file. Fixed in Oct 2023 Windows updates; WordPad is gone in 24H2. Find unpatched stragglers."
type: security-brief
section: "Security Digest"
date_published: 2023-10-10
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-36563"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# WordPad CVE-2023-36563: Exploited NTLM Hash Leak

**Verdict: Check exposure.** Any Windows machine that took a monthly update after October 2023 is fixed, and WordPad no longer ships in Windows 11 24H2 or Server 2025; what is left is finding unpatched stragglers and limiting outbound NTLM.

- **Who must act:** Teams with Windows 10, Windows 11 22H2 or earlier, or Windows Server 2008 through 2022 machines that have missed updates since October 2023, such as kiosks, lab PCs and isolated servers.
- **Who can relax:** Fleets on current cumulative updates, and machines on Windows 11 24H2 or later or Windows Server 2025, where Microsoft has removed WordPad.
- **Affected:** Windows 11 21H2 before 22000.2538 and 22H2 before 22621.2428; Windows 10 1507, 1607, 1809, 21H2 and 22H2 before the October 10, 2023 update; Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019 and 2022 (including Server Core) before the October 10, 2023 update
- **Fixed:** Windows 11 22H2: KB5031354 (22621.2428); Windows 11 21H2: KB5031358 (22000.2538); Windows 10 21H2/22H2: KB5031356 (19045.3570 on 22H2); Windows 10 1809 / Server 2019: KB5031361 (17763.4974); Windows 10 1607 / Server 2016: KB5031362 (14393.6351); Windows 10 1507: KB5031377 (10240.20232); Windows Server 2022: KB5031364 (20348.2031); Windows Server 2012 R2: KB5031419 rollup or KB5031407 security-only (6.3.9600.21620); Windows Server 2012: KB5031442 / KB5031427; 2008 R2 SP1: KB5031408 / KB5031441; 2008 SP2: KB5031416 / KB5031411
- **CVEs:** CVE-2023-36563
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find Windows machines whose build is below the October 2023 floor for their version, using your patch tool or the UBR registry value.
2. Install the current cumulative update on every straggler; isolate or retire Windows Server 2008 and 2012 hosts that no longer receive monthly rollups.
3. Block outbound SMB (TCP 445) from workstations and servers to the internet.
4. Set 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to Audit all, review the NTLM operational log, then move to Deny all with exceptions where you can.
5. Have users open .rtf and .doc attachments in Microsoft Word, as Microsoft recommends, rather than WordPad.

### How to check if you are affected

- Compare each machine's CurrentBuild and UBR registry values (or winver) with the fixed builds for its Windows version.
- Search firewall and proxy logs for outbound SMB (TCP 445) or WebDAV traffic from user machines to internet addresses, especially right after someone opened an .rtf or .doc file.
- Hunt in EDR for wordpad.exe making network connections or opening files from mail and download folders.
- With NTLM auditing on, review Applications and Services Logs\Microsoft\Windows\NTLM for outgoing NTLM authentication to unfamiliar servers.

## What happened

On October 10, 2023, Microsoft patched [CVE-2023-36563](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36563), an information disclosure flaw in WordPad, the basic rich-text editor that shipped with Windows at the time. Microsoft's FAQ says exploitation "could allow the disclosure of NTLM hashes." It also says the attacker "must send the user a malicious file and convince them to open it." Microsoft marked the bug as both publicly disclosed and exploited, and credited Microsoft Threat Intelligence. It published no attack details or indicators. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36563) the same day, with an October 31, 2023 federal deadline.

Microsoft scores it CVSS 3.1 6.5. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-36563) gives it 5.5, treating the attack vector as local. [Tenable](https://www.tenable.com/blog/microsofts-october-2023-patch-tuesday-addresses-103-cves-cve-2023-36563-cve-2023-41763) called it the third 2023 zero-day that could leak NTLM hashes. Microsoft's [NTLM policy guidance](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers) explains the stakes: NTLM is "vulnerable to various malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks."

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-36563) covers every Windows line Microsoft was patching that month: Windows 10 1507, 1607, 1809, 21H2 and 22H2, Windows 11 21H2 and 22H2, and Windows Server 2008 SP2 through 2022, including Server Core. Examples of fixed builds: Windows 11 22H2 22621.2428 (KB5031354) and Server 2022 20348.2031 (KB5031364).

WordPad itself is on its way out. Microsoft announced its deprecation on September 1, 2023. Its [deprecated features list](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features) now says WordPad "will be removed from all editions of Windows starting in Windows 11, version 24H2 and Windows Server 2025." The [removal notes](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features-resources) name the binaries that go with it: `wordpad.exe`, `wordpadfilter.dll` and `write.exe`.

## Do you really need to act?

Probably not, if your machines are patched. Windows cumulative updates carry forward earlier fixes, so any machine that installed a monthly update after October 2023 is covered. Newer releases no longer include WordPad at all. What remains is machines that quietly stopped patching, such as kiosks, lab PCs, isolated servers and old 2008 and 2012 hosts. There is also the technique itself: crafted documents that make Windows send NTLM credentials to an attacker keep turning up, and blocking outbound NTLM also blunts the next one.

## What to do now

1. Check builds. In PowerShell, run `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild, UBR` and compare the result with the fixed build for that version.
2. Install the current cumulative update on any straggler. If a 2008 or 2012 server no longer gets monthly rollups, isolate or retire it.
3. Block outbound SMB to the internet at the perimeter, and on hosts with a rule such as `New-NetFirewallRule -DisplayName "Block SMB to Internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action Block`.
4. Under `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options`, set "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" to Audit all. Review the results, then move to Deny all with a server exception list where you can.
5. Have users open .rtf and .doc files in Microsoft Word, Microsoft's recommended replacement.

## How to tell if you were hit

Microsoft has not released indicators, so hunt for behavior. Look in firewall and proxy logs for user machines sending SMB (TCP 445) or WebDAV traffic to internet addresses, especially just after someone opened an .rtf or .doc attachment. In EDR, look for `wordpad.exe` making network connections. Once auditing is on, the NTLM operational log under `Applications and Services Logs\Microsoft\Windows\NTLM` records outgoing NTLM attempts and the servers they went to. If you find a leak, reset that user's password and check their sign-ins for relay activity from unexpected hosts. Logs from 2023 have likely aged out, so focus on machines that are still unpatched.

## Timeline

- Sep 1, 2023 — Microsoft announces that WordPad is deprecated.
- Oct 10, 2023 — Microsoft fixes CVE-2023-36563 and marks it exploited and publicly disclosed. CISA adds it to KEV.
- Oct 11, 2023 — Microsoft updates the advisory's FAQ.
- Oct 31, 2023 — CISA's remediation deadline for federal agencies.

## Sources

1. [Microsoft MSRC — CVE-2023-36563 Microsoft WordPad Information Disclosure Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36563)
2. [Microsoft MSRC — October 2023 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Oct)
3. [CVE record — CVE-2023-36563](https://www.cve.org/CVERecord?id=CVE-2023-36563)
4. [NVD — CVE-2023-36563](https://nvd.nist.gov/vuln/detail/CVE-2023-36563)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-36563](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36563)
6. [Microsoft Learn — Deprecated features in the Windows client](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features)
7. [Microsoft Learn — Resources for deprecated features in the Windows client](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features-resources)
8. [Microsoft Learn — Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers)
9. [Tenable — Microsoft's October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)](https://www.tenable.com/blog/microsofts-october-2023-patch-tuesday-addresses-103-cves-cve-2023-36563-cve-2023-41763)
10. [Help Net Security — Microsoft fixes exploited WordPad, Skype for Business zero-days](https://www.helpnetsecurity.com/2023/10/10/cve-2023-36563-cve-2023-41763/)

---
Source page: https://erroneo.us/security/briefs/wordpad-cve-2023-36563-ntlm-hash-disclosure/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt