CVE-2024-10972
HIGH EPSS 5.4%
Published Dec 16, 20241y ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
Published Dec 16, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being performed at the beginning of the routine allowing the userspace to change page permissions half way through the routine. A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality Low
Integrity Low
Availability High
Threat Intelligence
EPSS Exploit Probability
5.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-367
References 1
- github.com https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.