Vulnerability · Published Sep 12, 2024 · Assigned by talos
CVE-2024-45383
Medium 5.0
In plain English
A medium-severity security flaw in HDAudBus.sys from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | HDAudBus.sys | 10.0.19041.3636 (WinBuild.160101.0800) |
Weakness: CWE-664 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H