Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Search Service Elevation of Privilege Vulnerability

CVE-2024-30040 is a high-severity (CVSS 8.8) security feature bypass in the Windows MSHTML platform, the HTML-rendering engine component embedded in Internet Explorer and many Windows applications. A remote attacker can trigger it by persuading a user to open or render specially crafted content, since the attack requires user interaction but no privileges or special conditions (AV:N/AC:L/PR:N/UI:R). Successful exploitation defeats an intended Windows security feature, and the high confidentiality, integrity, and availability impact ratings indicate it can enable significant compromise when chained with other techniques. All supported Windows 10 and Windows 11 client releases (1507 through 22H2, and 21H2 through 23H2, respectively) plus Windows Server 2016, 2019, 2022, and 2022 23H2 are affected. The flaw is being actively exploited in the wild — it was added to CISA's KEV catalog on 2024-05-14 and was one of two zero-days fixed in Microsoft's May 2024 Patch Tuesday — though no public proof-of-concept is known and EPSS estimates a 3.9% chance of exploitation in the next 30 days (90th percentile).

Do: Apply the May 2024 Patch Tuesday cumulative updates (released 2024-05-14) for Windows 10, Windows 11, and Windows Server as soon as possible; the flaw is under active exploitation and listed in CISA KEV, so prioritize endpoints and servers that render untrusted documents or HTML content. Confirm via patch reporting that the May 2024 cumulative update is installed on all assets, and in the interim caution users against opening unsolicited files and links, since exploitation requires user interaction.

CVE-2024-30051 is a heap-based buffer overflow / out-of-bounds write (CWE-122, CWE-787) in the Windows Desktop Window Manager (DWM) Core Library that allows a local attacker to escalate privileges. It is triggered by locally executing crafted code that corrupts memory in the DWM component, requiring only low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N). A successful exploit yields high-impact gains on the local system — typically elevation to elevated/SYSTEM rights, giving the attacker full control of confidentiality, integrity and availability on that host. Any organization running the affected Windows 10/11 client releases or Windows Server 2016/2019/2022 with the DWM component is exposed, which in practice means nearly every modern Windows endpoint. The flaw was a zero-day exploited in the wild before remediation: it was added to CISA KEV on 2024-05-14 with known ransomware use, and public reporting ties it to QakBot attack chains and Microsoft's May 2024 Patch Tuesday (which also fixed it alongside other exploited zero-days).

Do: Apply Microsoft's May 2024 Patch Tuesday cumulative updates for every affected Windows 10/11 and Windows Server 2016/2019/2022 release immediately; per CISA KEV, apply vendor mitigations or discontinue use of affected systems if updates are unavailable. Prioritize endpoints and servers exposed to user-driven malware (email, web browsing) since the flaw is chained after initial access in QakBot and ransomware operations, and verify patched DWM/dwmcore binaries via the updated OS build. Monitor for local privilege-escalation activity and treat this as a high-priority patch alongside the other May 2024 exploited zero-days.

CVE-2024-4671 is a use-after-free (CWE-416) in the Visuals component of Google Chrome and Chromium, fixed in Chrome 124.0.6367.201. It is triggered via a crafted HTML page, but the attacker must already have compromised the browser's renderer process, so this flaw is typically chained with a renderer exploit rather than used standalone. Successful exploitation enables a sandbox escape, letting the attacker break out of Chrome's renderer sandbox and gain broader access to the system beyond the browser tab. All users of Google Chrome versions prior to 124.0.6367.201 are affected, and per CISA's CPE data, Fedora's packaged Chromium builds are also in scope. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-05-13, indicating active exploitation in the wild; no public proof-of-concept is known, EPSS estimates an 8.3% chance of exploitation within 30 days (95th percentile), and ransomware association is unknown.

Do: Update Google Chrome to 124.0.6367.201 or later (verify via chrome://settings/help, since Chrome auto-updates may lag), and update Fedora's chromium package to the fixed build; CISA KEV requires federal agencies to apply the vendor fix on the mandated timeline. Because this sandbox escape must be chained with a renderer compromise, defenders should treat any unpatched Chrome deployment as exposed and confirm via EDR logs whether suspicious renderer-process activity occurred; enterprise admins should push the update through managed-browser channels immediately.

CVE-2024-4761 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by persuading a user to load a crafted HTML page, causing V8 to write beyond allocated memory bounds. Successful exploitation yields a high-impact memory corruption condition that can compromise confidentiality, integrity, and availability, potentially enabling arbitrary code execution within the browser process. All Google Chrome releases prior to 124.0.6367.207 are affected, as are Chromium-based distributions such as Fedora's Chromium package. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-05-16, confirming it is being exploited in the wild, and Google patched it in Chrome 124.0.6367.207.

Do: Update Google Chrome to 124.0.6367.207 or later on all platforms and verify the running version at chrome://settings/help; Fedora administrators should install the patched chromium package from the Fedora repositories as soon as available. Because the flaw is confirmed exploited in the wild and listed in CISA KEV, treat patching as urgent, prioritizing workstations and servers with browsers used to access untrusted web content. As an interim mitigation, restrict high-risk users' web browsing or isolate browsers until updates are applied.