CVE-2024-38080

HIGH CISA KEV EPSS 93.5%
Published Jul 9, 20241y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jul 9, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Jul 9, 2024 1y ago
KEV Due Jul 30, 2024 701d overdue

Description

Windows Hyper-V Elevation of Privilege Vulnerability

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 701d
Added
Jul 9, 2024
Due
Jul 30, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
93.5% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 5

VendorProductVersionRange
microsoftwindows_11_21h2* <10.0.22000.3079
microsoftwindows_11_22h2* <10.0.22621.3880
microsoftwindows_11_23h2* <10.0.22631.3880
microsoftwindows_server_2022* <10.0.20348.2582
microsoftwindows_server_2022_23h2* <10.0.25398.1009

References 2

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38080
    PatchVendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38080
    US Government Resource

Remediation

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38080
    PatchVendor Advisory