{"vulnerability": "cve-2023-32054", "sightings": [{"uuid": "53fca730-13e9-4b6b-b1c0-73d6571bdf43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32054", "type": "seen", "source": "https://t.me/cibsecurity/66436", "content": "\u203c CVE-2023-32054 \u203c\n\nVolume Shadow Copy Elevation of Privilege Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-11T22:36:06.000000Z"}, {"uuid": "ca888c75-81a2-4b39-9a66-15b5538479b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32054", "type": "seen", "source": "https://t.me/sysadm_in_up/2119", "content": "MagicDot: A Hacker\u2019s Magic Show of Disappearing Dots and Spaces\n\nThis action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:\n\n\ud83d\udd39 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows\u2019s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.\n\ud83d\udd39 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.\n\nWith Demo..:\n\nhttps://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/", "creation_timestamp": "2026-07-30T00:03:03.592399Z"}, {"uuid": "002d3e51-e4d0-4f65-a471-c1250d566db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32054", "type": "published-proof-of-concept", "source": "https://t.me/sysadm_in_up/2119", "content": "MagicDot: A Hacker\u2019s Magic Show of Disappearing Dots and Spaces\n\nThis action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:\n\n\ud83d\udd39 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows\u2019s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.\n\ud83d\udd39 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.\n\nWith Demo..:\n\nhttps://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/", "creation_timestamp": "2026-08-04T01:00:03.695304Z"}, {"uuid": "2ca07bc4-ee97-453d-8fa9-c210ecbf530a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32054", "type": "published-proof-of-concept", "source": "https://t.me/sysadm_in_up/2119", "content": "MagicDot: A Hacker\u2019s Magic Show of Disappearing Dots and Spaces\n\nThis action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:\n\n\ud83d\udd39 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows\u2019s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.\n\ud83d\udd39 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.\n\nWith Demo..:\n\nhttps://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/", "creation_timestamp": "2026-08-05T00:01:00.003079Z"}, {"uuid": "ea7800e0-20f3-41fe-9668-edf1b531b044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32054", "type": "seen", "source": "https://t.me/sysadm_in_up/2119", "content": "MagicDot: A Hacker\u2019s Magic Show of Disappearing Dots and Spaces\n\nThis action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:\n\n\ud83d\udd39 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows\u2019s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.\n\ud83d\udd39 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.\n\nWith Demo..:\n\nhttps://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/", "creation_timestamp": "2026-07-29T12:03:17.857672Z"}]}