CVE-2024-29988: high-severity vulnerability in Microsoft Windows 10 Version 1809
SmartScreen Prompt Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft SmartScreen's security prompt can be bypassed by an attacker, allowing malicious files or websites to bypass safety warnings. This means users might not see protective warnings they normally would, putting their systems at risk.
The vulnerability allows an attacker to bypass SmartScreen's prompt security feature through improper validation of user interaction or URL/file handling, potentially via specially crafted inputs. Exploitation requires user interaction but can result in execution of malicious code or navigation to harmful sites without security warnings.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.