Microsoft WordPad Information Disclosure Vulnerability (CVE‑2023‑36563)
What It Is – Microsoft WordPad contains an undocumented flaw that can allow an attacker to read arbitrary data from the host system. The issue is classified as an information‑disclosure vulnerability.
Exploitability – No public proof‑of‑concept has been released, but the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating that active exploitation is plausible. The CVSS base score is 6.5 (Medium).
Affected Products – Microsoft Windows installations that include WordPad (all supported Windows 10 and Windows 11 versions).
Why It Matters for Trust & Control Assurance
- Data confidentiality controls – An information‑disclosure flaw tests whether your organization can demonstrate that data at rest is protected by documented controls and evidence.
- Continuous control monitoring – Detecting and remediating such flaws requires a process that continuously maps patches to the relevant control objectives, providing audit‑ready evidence.
- Defensible audit trail – Enterprises increasingly need to show regulators and partners that they have a documented, repeatable response to newly disclosed vulnerabilities.
Recommended Actions
- Apply the Microsoft security update that addresses CVE‑2023‑36563 as soon as it is available.
- Verify that endpoint hardening policies (e.g., application allow‑lists, least‑privilege execution) are enforced for WordPad and similar utilities.
- Capture remediation evidence in your control‑mapping repository to demonstrate compliance with data‑confidentiality objectives.
Source: CISA KEV – CVE‑2023‑36563