erroneo.us
Search all guides⌘K

Security Digest · Feb 13, 2024 · Vulnerability · OS / kernel

Nine Windows Privilege-Escalation Bugs Exploited in 2024

Nine exploited Windows privilege-escalation bugs from 2024, appid.sys to CLFS. Any cumulative update since Dec 10, 2024 fixes all; find hosts that lag.

Published By erroneo.us Security Desk · Updated 4 min read21 sources

Our verdict

Check exposure

All nine are fixed by any Windows cumulative update from December 10, 2024 onward; the job now is to find machines that stopped patching and to check hosts that were unpatched while these campaigns ran.

Who must act: Owners of Windows 10, Windows 11 and Windows Server machines with no cumulative update since December 2024, including frozen VM templates, servers left out of patch rings and Windows 10 devices past end of support without ESU.

Who can relax: Fleets on a current monthly cumulative update are fixed for all nine, and none of these bugs lets an attacker in without code already running on the machine.

Affected
Windows 10 1507, 1607, 1809, 21H2 and 22H2 before the update that fixed each CVE
Windows 11 21H2, 22H2, 23H2 and 24H2 before the update that fixed each CVE
Windows Server 2016, 2019, 2022, 2022 23H2 and 2025 before the update that fixed each CVE
Windows Server 2012 R2 for six of the nine (ESU only), plus Server 2012 and 2008 for some
Fixed in
Patch Tuesday updates of Feb 13, Mar 12, Jun 11, Aug 13, Sep 10, Nov 12 and Dec 10, 2024
December 2024 cumulative updates cover all nine: KB5048652 (Windows 10 21H2/22H2), KB5048685 (Windows 11 22H2/23H2), KB5048667 (Windows 11 24H2 / Server 2025), KB5048654 (Server 2022), KB5048661 (Server 2019), KB5048671 (Server 2016)
KB5048735 monthly rollup (Server 2012 R2, ESU)
Any later cumulative update
CVSS
7.8 (v3.1, vendor)
EPSS
59.8% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Read the build and UBR on every Windows host and flag anything below the December 2024 builds (19045.5247, 22631.4602, 26100.2605, 20348.2966, 17763.6659, 14393.7606).
  2. Install the current cumulative update on anything behind, not just December 2024's, and rebuild old VM templates and golden images.
  3. Enroll Windows 10 and Server 2012/2012 R2 machines in ESU or replace them; unsupported hosts miss the 2025-2026 fixes for the same drivers.
  4. Leave the Windows Installer fix on: do not set DisableLUAInRepair to 1.
  5. Keep Chrome, Edge and Firefox current, since two of these chains started with browser zero-days.

How to check if you are affected or compromised

  • Check for a Debugger value under the Image File Execution Options key for WerFault.exe, the change made by the Black Basta-linked CVE-2024-26169 tool.
  • Hunt for RomCom artifacts from ESET: a scheduled task named firefox.exe, PocLowIL.dll, public.exe or epublic.exe.
  • Search DNS and proxy logs for voyagorclub[.]space and weinsteinfrog[.]com from Microsoft's Citrine Sleet report.
  • Look for EDR sensors that went silent or crash dumps switched off without an admin change, which matches FudModule rootkit behavior; Gen publishes YARA rules for it.

What happened#

Between February and December 2024, Microsoft fixed nine Windows privilege-escalation bugs that attackers had used, and CISA added each one to its KEV catalog. None of them lets an attacker in. Each turns code already running on a machine into SYSTEM or kernel access, or in one case into an escape from a browser sandbox. Microsoft rates all nine Important, with CVSS 3.1 scores from 7.0 to 8.8. CISA marks three as used in ransomware campaigns: CVE-2024-21338, CVE-2024-26169 and CVE-2024-49039. The DWM zero-day CVE-2024-30051 from May 2024 has its own brief.

  • CVE-2024-21338, AppLocker driver appid.sys, fixed Feb 13. Avast reported it in August 2023 after finding North Korea's Lazarus Group using it to cross from admin to kernel and load the FudModule rootkit. The rootkit tried to suspend Microsoft Defender, CrowdStrike Falcon and HitmanPro. Microsoft marked the bug exploited on Feb 28.
  • CVE-2024-26169, Windows Error Reporting, fixed Mar 12. Microsoft still lists it as not exploited. Symantec found an exploit tool in a failed Black Basta attack. Its compile timestamps, December 18, 2023 and February 27, 2024, suggest use before the patch.
  • CVE-2024-35250, Kernel Streaming (ks.sys), fixed Jun 11. DEVCORE used it at Pwn2Own Vancouver 2024 and says the flaw dates back to Windows 7. Exploit code went public about four months after the patch, BleepingComputer reported. CISA added it on Dec 16. No attacker has been named.
  • CVE-2024-38106 (kernel race condition), CVE-2024-38107 (Power Dependency Coordinator) and CVE-2024-38193 (afd.sys), all fixed Aug 13. Microsoft says North Korea's Citrine Sleet used CVE-2024-38106 to escape the browser sandbox after exploiting the Chromium zero-day CVE-2024-7971, then loaded FudModule. Gen found a Lazarus sample using CVE-2024-38193 in early June, in an operation aimed at aerospace and cryptocurrency engineering. Details on CVE-2024-38107 were not disclosed as of Oct 23, 2026.
  • CVE-2024-38014, Windows Installer, fixed Sep 10. SEC Consult showed that an MSI repair, which any user can start, could open a SYSTEM console window that a user at the desktop could turn into a SYSTEM shell. The fix adds a UAC prompt. Who exploited it has not been disclosed.
  • CVE-2024-49039, Task Scheduler, fixed Nov 12, CVSS 8.8. ESET found the Russia-aligned RomCom group chaining it with Firefox's CVE-2024-9680 to run code outside the browser sandbox, mostly against targets in Europe and North America.
  • CVE-2024-49138, Common Log File System driver, fixed Dec 10. Microsoft credits CrowdStrike and marks it publicly disclosed and exploited. Tenable noted no attack details were known.

Who is affected#

Windows 10, Windows 11 and Windows Server 2016 through 2025 builds older than each fix. Server 2012 R2 is listed for six of the nine. Cumulative updates include earlier fixes, so any machine on the December 10, 2024 update or later has all nine. The December builds were 19045.5247 (Windows 10 22H2), 22631.4602 (Windows 11 23H2), 26100.2605 (Windows 11 24H2 and Server 2025), 20348.2966 (Server 2022), 17763.6659 (Server 2019) and 14393.7606 (Server 2016). Hotpatched servers show lower numbers.

Do you really need to act?#

For a patched fleet, no. Every bug needs a foothold first, and the newest fix is 22 months old. Three gaps remain. Windows 10 reached end of support on October 14, 2025, per Microsoft's lifecycle list, so devices outside ESU miss newer fixes. The same drivers keep breaking: KEV lists later exploited bugs in afd.sys (CVE-2025-21418, CVE-2025-32709, CVE-2026-68820) and CLFS (CVE-2025-29824, CVE-2025-32701, CVE-2025-32706), so "past December 2024" is not enough. And three of these chains ended in FudModule, a rootkit built to blind EDR, which a later patch does not remove.

What to do now#

  1. Read each host's build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild, UBR. Anything below the December 2024 builds is missing at least one fix.
  2. Install the current cumulative update on anything behind, and rebuild old VM templates.
  3. Enroll Windows 10 and Server 2012/2012 R2 in ESU, or replace them.
  4. Do not set DisableLUAInRepair to 1. SEC Consult notes it restores the old Installer behavior.
  5. Keep browsers current. The fixes for the two browser zero-days were Chrome 128.0.6613.84 and Firefox 131.0.2.

How to tell if you were hit#

  • Run reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe" /v Debugger. Symantec says the Black Basta tool set this value to its own executable.
  • Hunt for ESET's RomCom artifacts: a scheduled task named firefox.exe, PocLowIL.dll, public.exe or epublic.exe.
  • Search DNS and proxy logs for voyagorclub[.]space and weinsteinfrog[.]com from Microsoft's report.
  • Run Gen's FudModule YARA rules, and look for EDR agents that went silent or crash dumps switched off without an admin change.

Timeline#

  • — CVE-2024-21338 fixed. Marked exploited Feb 28; added to KEV Mar 4.
  • — CVE-2024-26169 fixed. Symantec links it to Black Basta on Jun 12; KEV Jun 13.
  • — CVE-2024-35250 fixed.
  • — CVE-2024-38106, CVE-2024-38107 and CVE-2024-38193 fixed and added to KEV.
  • — CVE-2024-38014 fixed and added to KEV.
  • — CVE-2024-49039 fixed and added to KEV. ESET publishes Nov 26.
  • — CVE-2024-49138 fixed and added to KEV.
  • — CISA adds CVE-2024-35250.
  • — Windows 10 reaches end of support.

Vulnerability records

  • CVE-2024-21338 · KEV 2024-03-04 · Windows Kernel Elevation of Privilege Vulnerability
  • CVE-2024-26169 · KEV 2024-06-13 · Windows Error Reporting Service Elevation of Privilege Vulnerability
  • CVE-2024-35250 · KEV 2024-12-16 · Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
  • CVE-2024-38106 · KEV 2024-08-13 · Windows Kernel Elevation of Privilege Vulnerability
  • CVE-2024-38107 · KEV 2024-08-13 · Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
  • CVE-2024-38193 · KEV 2024-08-13 · Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
  • CVE-2024-38014 · KEV 2024-09-10 · Windows Installer Elevation of Privilege Vulnerability
  • CVE-2024-49039 · KEV 2024-11-12 · Windows Task Scheduler Elevation of Privilege Vulnerability
  • CVE-2024-49138 · KEV 2024-12-10 · Windows Common Log File System Driver Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Microsoft — Security Update Guide: CVE-2024-21338 msrc.microsoft.com
  2. Microsoft — Security Update Guide: CVE-2024-26169 msrc.microsoft.com
  3. Microsoft — Security Update Guide: CVE-2024-35250 msrc.microsoft.com
  4. Microsoft — Security Update Guide: CVE-2024-38106 msrc.microsoft.com
  5. Microsoft — Security Update Guide: CVE-2024-38107 msrc.microsoft.com
  6. Microsoft — Security Update Guide: CVE-2024-38193 msrc.microsoft.com
  7. Microsoft — Security Update Guide: CVE-2024-38014 msrc.microsoft.com
  8. Microsoft — Security Update Guide: CVE-2024-49039 msrc.microsoft.com
  9. Microsoft — Security Update Guide: CVE-2024-49138 msrc.microsoft.com
  10. Microsoft — December 2024 Security Updates (CVRF) api.msrc.microsoft.com
  11. CISA — Known Exploited Vulnerabilities: CVE-2024-35250 cisa.gov
  12. Avast / Gen — Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day gendigital.com
  13. Gen — Evolution of Lazarus FudModule (CVE-2024-38193) gendigital.com
  14. Microsoft Threat Intelligence — North Korean threat actor Citrine Sleet exploiting Chromium zero-day microsoft.com
  15. Symantec — Ransomware Attackers May Have Used Privilege Escalation Vulnerability as Zero-day security.com
  16. DEVCORE — Streaming vulnerabilities from Windows Kernel - Proxying to Kernel - Part I devco.re
  17. SEC Consult — Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey sec-consult.com
  18. ESET — RomCom exploits Firefox and Windows zero days in the wild welivesecurity.com
  19. Microsoft Learn — Ending Support in 2025 learn.microsoft.com
  20. Tenable — Microsoft's December 2024 Patch Tuesday Addresses 70 CVEs (CVE-2024-49138) tenable.com

Coverage and analysis

  1. BleepingComputer — Windows kernel bug now exploited in attacks to gain SYSTEM privileges bleepingcomputer.com