CVE-2024-30051KEV · OVERDUECWE-122

Windows DWM Core Library Elevation of Privilege Vulnerability

High · published May 14, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 93.0th percentile for exploit probability.

873
days past CISA
deadline
CVSS v3.1
7.8
EPSS
6%
Percentile
93.0
In the wild
Confirmed
What it is

⚡ A crafty user can gain elevated privileges through a simple exploit in the Windows DWM Core Library! 🎭 Think of it like an unaccompanied child sneaking into an adult-only event at a hotel — once they're in, they can access all the restricted areas without anyone noticing. This flaw lets attackers bypass normal permissions and take control of sensitive parts of the system. This vulnerability could allow an unauthorized user to elevate their privileges, leading to full system access. An attacker could manipulate data, install malicious software, or even take over the entire system, putting your sensitive information at serious risk!

Put simply

Think of it like an unaccompanied child sneaking into an adult-only event at a hotel — once they're in, they can access all the restricted areas without anyone noticing. This flaw lets attackers bypass normal permissions and take control of sensitive parts of the system. This Windows DWM Core Library vulnerability allows an attacker to exploit specific conditions to gain elevation of privilege, making it possible for unauthorized actions to be performed on the operating system.

What to do

This vulnerability could allow an unauthorized user to elevate their privileges, leading to full system access. An attacker could manipulate data, install malicious software, or even take over the entire system, putting your sensitive information at serious risk! To protect yourself, update your Windows systems immediately to the latest patch version. Regularly review user privileges and ensure that only authorized users have access to sensitive information. Stay vigilant and monitor for any unusual activity! You've got this! Patch up and secure your systems, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.05687 · 93.0th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2024-05-14T16:57Z
KEV added
2024-05-14 · due 2024-06-04
EPSS history
Timeline
  • 14 MAY 16:57Z
    Windows DWM Core Library Elevation of Privilege Vulnerability
    cvelistv5
  • 14 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 4
    kev