Microsoft Patch Tuesday security updates for August 2024 six actively exploited bugs

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Windows TCP/IP Remote Code Execution Vulnerability

The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free flaw (CWE-416) that allows a local attacker to escalate privileges. An attacker who can already execute code on a Windows host — typically after gaining initial access via phishing, malware, or chaining with another vulnerability — triggers the bug to gain SYSTEM-level privileges, giving them near-full control of the machine. Any Windows host running an affected build is exposed to the flaw, though it requires local code execution and is not remotely exploitable on its own. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2024-08-13 and Microsoft shipped fixes in its August 2024 security updates, while the ransomware association is currently listed as unknown. EPSS is elevated at 28.5% (98th percentile), indicating a high likelihood of continued exploitation over the next 30 days.

Do: Apply Microsoft's August 2024 Windows cumulative security updates (released 2024-08-13) across all Windows clients and servers, prioritizing multi-user hosts such as RDS/VDI servers and jump boxes where local code execution by low-privileged users is more likely. After patching, verify installed build numbers and hunt for signs of local privilege escalation, per CISA's KEV required action to apply vendor mitigations or discontinue use. Keep the host within your KEV remediation SLA, as listing in the catalog signals active exploitation.

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Windows Network Virtualization Remote Code Execution Vulnerability

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

CVE-2024-38189 is an improper input validation (CWE-20) remote code execution flaw in Microsoft Project. Triggering it requires user interaction: an attacker supplies a maliciously crafted Project file, and when a user opens it, the parsing flaw allows attacker-controlled input to execute code. Successful exploitation yields code execution in the context of the user who opened the file, with high impact to confidentiality, integrity, and availability on that endpoint. Per the CPE data, affected deployments include Project 2016 and the Project client shipped with Office 2019, Office LTSC, and Microsoft 365 Apps. The flaw was one of six zero-days Microsoft patched in its August 2024 Patch Tuesday release and was confirmed to be exploited in the wild, earning a CISA KEV listing on 2024-08-13; EPSS assigns an 8.2% 30-day exploitation probability (95th percentile), and no public PoC is known.

Do: Apply Microsoft's August 2024 Patch Tuesday security updates for Microsoft Project/Office (covering Project 2016 and the Project client in Office 2019, Office LTSC, and Microsoft 365 Apps) immediately, per the CISA KEV required action; as an interim measure, caution users against opening Project files from untrusted sources until patched. After updating, verify that the installed Project/Office build reflects the August 2024 security updates.

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.