CVE-2024-35250highunder attackCWE-822

CVE-2024-35250: high-severity vulnerability in Microsoft Windows 10 Version 1507

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Published · Updated

93Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 25%
from disclosure to weapon124 days
Published on NVDJun 11
1st PoC+124d
metasploitJun 11
CISA KEV+188d
exploitation probability
25%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
12 public exploit(s)
Action required by CISAfederal deadline: 2025-01-06

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Windows kernel-mode drivers allows attackers with local access to gain administrative privileges. This is serious because it lets ordinary users take complete control of the system.

Technical detail

A local privilege escalation vulnerability in Windows kernel-mode drivers (CWE-822: Improperly Controlled Critical Resource) enables attackers to execute arbitrary code with elevated privileges. Exploitation requires local system access; successful exploitation grants kernel-level control over the affected system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Windows 10 Version 1507Microsoft · Windows 10 Version 1607Microsoft · Windows 10 Version 1809Microsoft · Windows 10 Version 21H2Microsoft · Windows 10 Version 22H2Microsoft · Windows 11 version 21H2Microsoft · Windows 11 version 22H2Microsoft · Windows 11 version 23H2Microsoft · Windows Server 2008 R2 Service Pack 1Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)Microsoft · Windows Server 2008 Service Pack 2Microsoft · Windows Server 2008 Service Pack 2 (Server Core installation)Microsoft · Windows Server 2012Microsoft · Windows Server 2012 R2Microsoft · Windows Server 2012 R2 (Server Core installation)Microsoft · Windows Server 2012 (Server Core installation)Microsoft · Windows Server 2016Microsoft · Windows Server 2016 (Server Core installation)Microsoft · Windows Server 2019Microsoft · Windows Server 2019 (Server Core installation)Microsoft · Windows Server 2022Microsoft · Windows Server 2022, 23H2 Edition (Server Core installation)
public PoCs found — 12
githubgithub.com/yinsel/CVE-2024-35250-BOF★ 24githubgithub.com/ro0tmylove/CVE-2024-35250-BOF★ 13githubgithub.com/CrackerCat/CVE-2024-35250★ 9githubgithub.com/xvalegendary/HVCIPwned★ 7githubgithub.com/0xROOTPLS/GiveMeKernel★ 3vulncheckvulncheck.com/xdb/0b0840113d00unverifiedvulncheckvulncheck.com/xdb/562161991e78unverifiedvulncheckvulncheck.com/xdb/dd8d0f57f6a8unverifiedvulncheckvulncheck.com/xdb/46bcac6e7f22unverifiedvulncheckvulncheck.com/xdb/ad758b7b19feunverifiedvulncheckvulncheck.com/xdb/0d2b550a1e93unverifiedvulncheckvulncheck.com/xdb/e8420e7e6156unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Windows 10 Version 1507

In the same product, most dangerous first.

CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEVCVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEVCVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEVCVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 98.9%KEVCVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.5%KEVCVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.1%KEV
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-35250