CVE-2024-38060
Heap-based Buffer Overflow (CWE-122)
Summary
Windows Imaging Component Remote Code Execution Vulnerability. This vulnerability affects the Windows Imaging Component and allows for remote code execution. The vulnerability has a low attack complexity, requires low privileges, and no user interaction. It is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The vulnerability affects multiple versions of Windows, including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2, 23H2), Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2.
Impact
This vulnerability could allow an attacker to remotely execute code on the affected system with the same privileges as the vulnerable component. Given the high confidentiality, integrity, and availability impacts, a successful exploit could lead to unauthorized access to sensitive information, modification of system files or data, and potential disruption of system services. The attack vector is network-based, making it potentially accessible to remote attackers.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability as of July 9, 2024. Security teams should prioritize applying this patch to all affected systems.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible to all affected Windows versions. 2. Implement network segmentation to limit exposure of vulnerable systems. 3. Monitor for suspicious activities related to the Windows Imaging Component. 4. Apply the principle of least privilege to minimize the potential impact if exploited. 5. Keep all Windows systems and components up to date with the latest security updates. 6. If immediate patching is not possible, consider temporarily disabling or restricting access to the Windows Imaging Component until the patch can be applied.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
Detection for the vulnerability has been added to Qualys (92149)
A CVSS base score of 8.8 has been assigned.
NVD published the first details for CVE-2024-38060
Feedly found the first article mentioning CVE-2024-38060. See article
Feedly estimated the CVSS score as HIGH
CVE-2024-38060 is a critical Remote Code Execution vulnerability in the Windows Imaging Component, with a CVSSv3 score of 8.8. While there are no known exploits in the wild, attackers could potentially exploit this flaw by uploading a malicious TIFF file. Microsoft has not released a patch yet, so users are advised to be cautious when handling image files to mitigate the risk of exploitation. See article
EPSS Score was set to: 0.05% (Percentile: 19.6%)
This CVE started to trend in security discussions
This CVE stopped trending in security discussions