CVE-2024-43491CWE-416

Microsoft Windows Update Remote Code Execution Vulnerability

Critical · published September 10, 2024

CVSS v3.1
9.8
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

🚨 A rollback in fixes could let attackers stroll right through previously patched vulnerabilities on Windows 10 version 1507! 🔥 Think of it as a restaurant that was supposed to stop serving spoiled food but accidentally got a bad delivery and is unknowingly serving it again. In this case, the bad delivery is a servicing stack that reverted security measures meant to protect your system! An attacker could exploit these vulnerabilities and gain unauthorized access, potentially allowing them to steal sensitive data or control affected systems. Since the compromised version is still in use, particularly among certain enterprises, the risk of severe breaches is alarmingly high!

Put simply

Think of it as a restaurant that was supposed to stop serving spoiled food but accidentally got a bad delivery and is unknowingly serving it again. In this case, the bad delivery is a servicing stack that reverted security measures meant to protect your system! This vulnerability arises in the Servicing Stack of Windows 10 version 1507, allowing attackers to take advantage of vulnerabilities that were previously fixed. The rollback of these fixes poses a significant risk to systems still running this outdated version, specifically the Enterprise and IoT LTSB editions.

What to do

An attacker could exploit these vulnerabilities and gain unauthorized access, potentially allowing them to steal sensitive data or control affected systems. Since the compromised version is still in use, particularly among certain enterprises, the risk of severe breaches is alarmingly high! To mitigate this vulnerability, it's crucial to install the September 2024 Servicing Stack Update (KB5043936) followed by the September 2024 Windows Security Update (KB5043083) — make sure to do them in that order! If you're still running Windows 10 version 1507, consider upgrading to a supported version as soon as possible. You've got this! Follow these steps and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.12916 · 96.3th percentile
Weakness
CWE-416 · Use After Free
Published
2024-09-10T16:54Z
EPSS history
Timeline
  • 10 SEP 16:54Z
    Microsoft Windows Update Remote Code Execution Vulnerability
    cvelistv5