CVE-2024-38106KEV · OVERDUECWE-591

Windows Kernel Elevation of Privilege Vulnerability

High · published August 13, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.0. It is confirmed in active exploitation. It sits in the 93.6th percentile for exploit probability.

782
days past CISA
deadline
CVSS v3.1
7.0
EPSS
6%
Percentile
93.6
In the wild
Confirmed
What it is

🚨 A sneaky flaw in the Windows Kernel lets attackers elevate their privileges, opening the door to full system control! 🔥 Think of it like a janitor discovering a secret key to the CEO’s office — they could change documents, access sensitive information, or even lock the door behind them! If exploited, an attacker could gain access to the highest levels of the system, compromising sensitive data and potentially compromising the entire machine. This could lead to data breaches, loss of trust, and devastating operational impacts for users and organizations alike.

Put simply

Think of it like a janitor discovering a secret key to the CEO’s office — they could change documents, access sensitive information, or even lock the door behind them! This elevation of privilege vulnerability allows attackers to execute malicious code with higher privileges than intended, bypassing standard security protocols present within the Windows Kernel.

What to do

If exploited, an attacker could gain access to the highest levels of the system, compromising sensitive data and potentially compromising the entire machine. This could lead to data breaches, loss of trust, and devastating operational impacts for users and organizations alike. To mitigate this risk, ensure your systems are updated with the latest patches from Microsoft. Regularly audit user permissions to restrict access and consider implementing additional security measures like intrusion detection systems. You've got this! Stay vigilant and patch up to safeguard your systems! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.06337 · 93.6th percentile
Weakness
CWE-591 · Sensitive Data Storage in Improperly Locked Memory
Published
2024-08-13T17:29Z
KEV added
2024-08-13 · due 2024-09-03
EPSS history
Timeline
  • 13 AUG 17:29Z
    Windows Kernel Elevation of Privilege Vulnerability
    cvelistv5
  • 13 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 3
    kev