CVE-2024-43452

CVE-2024-43452 is an elevation of privilege vulnerability in the Microsoft Windows Registry caused by a time-of-check to time-of-use (TOCTOU) race condition (CWE-367). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the flaw is scored with a network trigger requiring user interaction, and because it is a race condition with high attack complexity, exploitation requires winning a timing race between a registry security check and the registry operation. An attacker who wins that race can make unauthorized registry changes with elevated rights, effectively escalating to administrator/SYSTEM-level privileges, typically as the second stage of a chain after initial code execution. All currently supported Windows client releases (Windows 10 1809/21H2/22H2, Windows 11 22H2/23H2/24H2) and Windows Server releases (2008, 2019, 2022, 2022 23H2, 2025) are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the issue is not in CISA's KEV catalog, but EPSS assigns a high 28.1% (98th percentile) probability of exploitation within the next 30 days.

What to do: Deploy Microsoft's security update for CVE-2024-43452 (November 2024) across all affected Windows 10/11 and Windows Server hosts, prioritizing multi-user systems such as RDS/session hosts and shared workstations where local privilege escalation is most impactful. No public workaround is known; until patched, enforce least-privilege accounts and caution around untrusted content or actions that trigger registry operations. Given the elevated EPSS score (28.1% within 30 days), monitor Microsoft advisories and threat intelligence for signs of weaponization.