CVE-2024-38106

CVE-2024-38106 is an elevation-of-privilege flaw in the Microsoft Windows kernel caused by a deleted-reference memory-safety weakness (CWE-591), a use-after-free-class bug that corrupts kernel memory. A local attacker with valid low-privileged credentials must run a specially crafted application to trigger the flaw; the attack is local with no user interaction required but is rated high in attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0 High). Successful exploitation elevates the attacker to kernel/SYSTEM-level privileges, giving full control of the compromised host. All supported Windows 10 branches (1507 through 22H2), Windows 11 (21H2 through 24H2), and Windows Server 2016, 2019, and 2022 are affected, meaning essentially the entire current Windows install base. The flaw is confirmed exploited in the wild: CISA added it to the KEV catalog on 2024-08-13, and headlines show it is among the six actively exploited zero-days Microsoft fixed in its August 2024 Patch Tuesday release; no public proof-of-concept is known, and EPSS estimates a 6.3% probability of exploitation in the next 30 days (93rd percentile).

What to do: Apply the August 2024 Patch Tuesday cumulative updates (released August 13, 2024) via Windows Update, WSUS, or Intune to every affected Windows 10, Windows 11, or Windows Server instance; this is a KEV-listed, actively exploited bug, so prioritize it in patch cycles. Until patched, restrict local code execution by untrusted or low-privileged users on high-value hosts and hunt for signs of unexpected local privilege escalation. Per CISA's required action, apply vendor mitigations per Microsoft's instructions or discontinue use of affected systems if mitigations are unavailable.