CVE-2024-49074 : Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Published 2024-12-10 17:49:09

Updated 2025-01-08 12:42:34

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2024-49074

Microsoft » Windows Server 2019
Versions before (<) 10.0.17763.6659
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019
Versions from including (>=) 10.0.0 and before (<) 10.0.17763.6659
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1809 » For X86
Versions before (<) 10.0.17763.6659
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
Matching versions
Microsoft » Windows 10 1809 » For X64
Versions before (<) 10.0.17763.6659
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
Matching versions
Microsoft » Windows 10 1809 » For X86
Versions from including (>=) 10.0.0 and before (<) 10.0.17763.6659
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
Matching versions
Microsoft » Windows 10 21H2 » For X86
Versions from including (>=) 10.0.0 and before (<) 10.0.19044.5247
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:
Matching versions
Microsoft » Windows 10 21h2
Versions before (<) 10.0.19044.5247
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22h2
Versions before (<) 10.0.19045.5247
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22H2 » For X64
Versions from including (>=) 10.0.0 and before (<) 10.0.19045.5247
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
Matching versions

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/...	N/A	N/A	Microsoft Corporation	2024-12-11
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	Microsoft Corporation	2024-12-12
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/...	N/A	N/A	MS-CVE-2024-49074	2024-12-11
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Assigned by: secure@microsoft.com (Secondary)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49074

CVE-2024-49074 - Security Update Guide - Microsoft - Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Vendor Advisory

Jump to