CVE-2024-30040: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows MSHTML Platform Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A security feature in Windows MSHTML (the rendering engine used by Internet Explorer and some Windows components) can be bypassed, allowing attackers to bypass protections that would normally prevent malicious actions. This matters because it could allow attackers to run arbitrary code or access sensitive information on affected systems.
This vulnerability in the MSHTML rendering engine permits circumvention of platform-level security mechanisms through improper input validation (CWE-20). An attacker can craft malicious content that exploits this bypass to execute code or escalate privileges; the attack vector is typically web-based (via compromised or malicious HTML content). The high CVSS score (8.8) indicates significant impact on system integrity and confidentiality.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.