# CVE-2023-36033: Windows DWM Core Library Elevation of Privilege Vulnerability

Arbitrary object dereference in DWM's CKeyframeAnimation::SampleStartingValue via shared-section pointer lets attacker leak heap address and execute shellcode in dwm.exe, escalating to SYSTEM.

- Payout: Real-world hack
- Severity: high
- Program: Windows 10, Windows Server 2019/2022, Windows 11
- Credited: Genwei Jiang, FLARE OTF
- Disclosed: 2023-11-14
- CVE: CVE-2023-36033
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2023/CVE-2023-36033.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2023-36033
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** dwmcore.dll CKeyframeAnimation::SampleStartingValue via DirectComposition channel
**Root cause:** CKeyframeAnimation::SampleStartingValue processes DCOMPOSITION_EXPRESSION_TYPE_PATH using a user-controlled data pointer from a shared section; ComPtr<CPathData>::operator= dereferences it, giving an arbitrary object dereference for leak and code execution.
**Steps:**
1. Create DirectComposition channel
2. Create CKeyframeAnimationMarshaler, CPathGeometryMarshaler, CSharedSectionMarshaler resources
3. Wire resources via crafted BatchBuffer and `NtDCompositionProcessChannelBatchBuffer`
4. Place fake object gadgets and leak buffer in shared section
5. Trigger vulnerable path via `NtDCompositionDestroyChannel` to leak heap address of gadget buffer copied into dwm.exe
6. Repeat with leaked address to detonate gadgets (SHCORE!IUnknown_AtomicRelease, SHCORE!IStream_Size, combase!CStdStubBuffer2::Disconnect) calling VirtualProtect and spawning thread to shellcode
**How found:** Manual analysis of DirectComposition internals; attacker understood undocumented resource properties and kernel/user dispatch flow. FLARE found a variant in CKeyframeAnimation::GetSamplesStartingValue with identical flaw.
**Exploitation:** Shellcode in dwm.exe (Window Manager\DWM) is a reflective DLL dropper writing C:\Users\Public\rdll.dll, hooks kernelbase!MapViewOfFile, triggers `shutdown /l`; LogonUI.exe (SYSTEM) then unmarshals DirectComposition objects, hook modifies vftable of dcomp!CSharedAllocation to detonate gadgets calling LoadLibraryA of rdll.dll in LogonUI.exe, adding admin user sec_ops.
**Escalation:** Chains DWM user code exec with a MapViewOfFile hook to hijack unmarshalling in SYSTEM LogonUI.exe, achieving SYSTEM.
**Insight:** DirectComposition shared-section pointers passed into ComPtr assignment operators are a recurring arbitrary-dereference primitive; audit CKeyframeAnimation/CPathData handling of DCOMPOSITION_EXPRESSION_TYPE_PATH and look for sibling methods (GetSamplesStartingValue) with the same pattern.