CVE-2024-38107

CVE-2024-38107 is a use-after-free (CWE-416) elevation-of-privilege vulnerability in the Windows Power Dependency Coordinator, rated 7.8 High (local attack, low required privileges, high impact on confidentiality, integrity and availability). It is triggered locally: an attacker who already holds valid low-privileged credentials and can execute code on a target Windows machine abuses the memory-handling bug to run code at elevated privilege. Successful exploitation yields high-privilege (kernel/SYSTEM-level) access on the host, enabling credential theft and follow-on activity such as malware or ransomware deployment. Affected products span Windows 10 (1507 through 22H2), Windows 11 (21H2 through 24H2) and Windows Server 2012/2016/2019, i.e., nearly the entire currently supported Windows installed base. The flaw is under active exploitation: CISA added it to the KEV on 2024-08-13 and it is one of six actively exploited zero-days patched in Microsoft's August 2024 Patch Tuesday; no public PoC is known and whether ransomware groups use it is unknown.

What to do: Apply Microsoft's August 2024 Patch Tuesday cumulative security updates (released August 13, 2024) to all affected Windows 10, Windows 11 and Windows Server systems, prioritizing hosts where untrusted or low-privileged users can run code. Because exploitation requires local access, review local user privileges and hunt for local privilege escalation activity on endpoints. Per CISA's KEV required action, apply vendor mitigations or discontinue use of affected Windows versions if updates are unavailable.