CVE-2024-21338
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
CVSS
7.8
High
EPSS
59.8%
p99
KEV
YES
Mar 4, 2024
Exploit Today
80
0-100
Published: Feb 13, 2024 · Last modified: Aug 10, 2026 · CWE-822
Product
Microsoft / Windows
Vulnerability
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Added to KEV
Mar 4, 2024
Remediate by
Mar 25, 2024
Known ransomware use
Yes
Summary description
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338; https://nvd.nist.gov/vuln/detail/CVE-2024-21338
Windows Kernel Elevation of Privilege Vulnerability
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
- decoded.avast.iohttps://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
- packetstorm.newshttps://packetstorm.news/files/id/190586/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/52275
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21338