Analysis of CVE-2023-36802

Welcome to my write‑up & walkthrough of CVE‑2023‑36802, a local privilege escalation vulnerability in the Microsoft Kernel Streaming Server
(mskssrv.sys).

What was this CVE about?

• The bug lived in mskssrv.sys, a driver that helps Windows handle multimedia streaming (e.g., cameras).
• It was a classic type confusion bug:
  • A small Context object (0x78 bytes) could be mistaken for a Stream object (0x1d8 bytes).
  • The driver blindly trusted the type and accessed memory beyond the actual object → out‑of‑bounds corruption.
• The difference in size (0x160 bytes) meant the driver would start reading or writing into whatever memory was next door in the kernel heap.

Build the sln file by Visual Studio 2022

Running the POC :

exploit.exe PID # find pid by 'tasklist | findstr <process.exe>'