CVE-2023-38146

Windows Themes Remote Code Execution Vulnerability

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

39.49% chance of exploitation in the next 30 days, 99th percentile

Published

2023-09-12

Updated

2025-10-30

Proof-of-concept exploits (5)

• Durge5/ThemeBleedPy2★ · 2023-12-12
• Jnnshschl/CVE-2023-3814627★ · 2024-05-01
• exploits-forsale/themebleed207★ · 2023-09-13
• gabe-k/themebleed207★ · 2023-09-13
• CH0ico/CVE-2023-38146-Poc

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/theme_dll_hij…

References

• CVE Record
• NVD entry

Related

• CVE-2024-21345
• CVE-2024-26218
• CVE-2024-30088
• CVE-2021-1883
• CVE-2025-13278
• CVE-2026-2159