CVE-2023-38146

Windows Themes Remote Code Execution Vulnerability

Windows Themes Remote Code Execution Vulnerability

Affected

Microsoft · Windows 11 version 21H2 · Windows 11 version 22H2

CVSS v3.1 MICROSOFT

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

37.38% chance of exploitation in the next 30 days, 99th percentile

Published

2023-09-12

Updated

2025-10-30

Proof-of-concept exploits (5)

• Durge5/ThemeBleedPy2★ · 2023-12-12
• Jnnshschl/CVE-2023-3814627★ · 2024-05-01
• exploits-forsale/themebleed206★ · 2023-09-13
• gabe-k/themebleed206★ · 2023-09-13
• CH0ico/CVE-2023-38146-Poc0★ · 2026-07-12

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/theme_dll_hij…

Security advisories

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38146

References

• CVE Record
• NVD entry

Related

• CVE-2024-21345
• CVE-2024-26218
• CVE-2024-30088
• CVE-2021-1883
• CVE-2025-13278
• CVE-2026-2159