CVE-2024-38217: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Mark of the Web Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A security feature in Windows that warns users about potentially dangerous files downloaded from the internet can be bypassed, allowing malicious files to run without the expected warning.
This vulnerability exploits improper validation of the Mark of the Web (MOTW) stream attribute in Windows, allowing an attacker to craft specially formatted files that bypass the security prompt mechanism designed to protect against execution of untrusted downloaded content. The attack requires user interaction to execute the file, but circumvents the warning dialog that would normally alert users to the risk.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.