Actively exploited · Published Aug 13, 2024 · Assigned by microsoft
CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
High 7.8 Exploited
In plain English
A high-severity use-after-free in Windows 10 Version 1507 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on August 13, 2024). The chance it is exploited in the next 30 days is estimated at 28.7% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 3, 2024.
Official description
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C