Windows DWM CVE-2024-30051: Zero-Day EoP Used With QakBot

What to do

1. Read the OS build and update revision (UBR) on every Windows host and compare it with the fixed builds.
2. Install the current cumulative update anywhere below them; every monthly update since May 2024 contains the fix.
3. Rebuild VM templates and golden images that predate May 2024.
4. Enroll out-of-support Windows 10 machines in ESU or upgrade them so they keep receiving fixes.
5. Rebuild any host that was unpatched in April-May 2024 and showed QakBot or Cobalt Strike detections, and reset credentials used on it.

How to check if you are affected or compromised

• Compare each host's build with the fixed builds; anything older was exploitable by any local user.
• Search AV/EDR history from April 2024 onward for QakBot, Cobalt Strike and Kaspersky verdicts such as PDM:Exploit.Win32.Generic or Trojan.Win32.CobaltStrike.gen.
• Look for SYSTEM-level processes started by user-context loaders on unpatched hosts, and for unexplained dwm.exe crashes in the Application log (event ID 1000).

What happened#

On May 14, 2024, Microsoft fixed CVE-2024-30051, an elevation-of-privilege bug in the Windows Desktop Window Manager (DWM) Core Library. Microsoft rated it Important (CVSS 3.1 7.8) and marked it as both publicly disclosed and exploited. A user who can already run code on the machine can gain SYSTEM. CISA added it to the KEV catalog the same day, classed it as a heap-based buffer overflow (CWE-122), and marks it as known to be used in ransomware campaigns.

Kaspersky explained how it surfaced. In early April 2024, while studying an earlier DWM zero-day (CVE-2023-36033), its researchers found a document uploaded to VirusTotal on April 1. It described a new DWM bug "in very broken English". They confirmed it was a real zero-day and reported it to Microsoft. In mid-April they found an exploit in their telemetry. Kaspersky said it had "seen it used together with QakBot and other malware, and believe that multiple threat actors have access to it." Microsoft also credits researchers at Google TAG, Mandiant and DBAPPSecurity WeBin Lab.

Who is affected#

Microsoft's update data lists Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2) and Windows Server 2016, 2019 and 2022, including Server Core. Fixed builds are 10240.20651, 14393.6981 (Server 2016), 17763.5820 (Server 2019), 19044/19045.4412, 22000.2960, 22621/22631.3593 and 20348.2461 for Server 2022 (20348.2458 via hotpatch). Windows Server 2012 R2 and earlier are not in Microsoft's affected list.

Do you really need to act?#

For a managed fleet this is now a compliance check, not an emergency. The bug is a second stage: the attacker already needs code running as a normal user, which is how QakBot used it. The fix is 29 months old, and every cumulative update since May 2024 includes it.

The remaining risk sits in three places:

• Machines that stopped updating. Windows 10 reached end of support on October 14, 2025, according to Microsoft's lifecycle list. Devices not enrolled in Extended Security Updates (ESU) are frozen at their last patch.
• Servers excluded from patch rings, and VM templates built before May 2024.
• The open question of whether a spring-2024 QakBot infection used this bug to get SYSTEM and was never cleaned up.

What to do now#

1. Read the build on each host: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild, UBR (or cmd /c ver). Compare it with the builds above.
2. Install the latest cumulative update through Windows Update, WSUS or Intune on anything older. The May 2024 packages were KB5037768 (Windows 10 21H2/22H2), KB5037771 (Windows 11 22H2/23H2), KB5037782 (Server 2022), KB5037765 (Server 2019) and KB5037763 (Server 2016). Later updates supersede them.
3. Patch or rebuild VM templates, golden images and offline machines before you bring them back into service.
4. Enroll out-of-support Windows 10 devices in ESU or upgrade them.
5. Rebuild any host that was unpatched in April and May 2024 and had QakBot or Cobalt Strike alerts, and reset every credential used on it.

How to tell if you were hit#

Kaspersky published no hashes or network indicators, only detection verdicts such as PDM:Exploit.Win32.Generic and Trojan.Win32.CobaltStrike.gen. Search AV and EDR history for these and for QakBot detections from April 2024 on, focusing on hosts that were unpatched then. On those hosts, look for SYSTEM-level processes started by user-context loaders, new services or scheduled tasks, and unexplained dwm.exe crashes (Application log, event ID 1000), which can accompany failed exploit attempts. CISA flags ransomware use, so if you find a QakBot foothold, check for lateral movement and credential theft before you clean up.

Timeline#

• Apr 1, 2024 — A document describing the DWM bug is uploaded to VirusTotal. Kaspersky later confirms it, reports it to Microsoft, and by mid-April sees it exploited alongside QakBot.
• May 14, 2024 — Microsoft ships the fix in Patch Tuesday. Kaspersky publishes, and CISA adds the CVE to KEV.
• Jun 4, 2024 — CISA's remediation deadline for federal agencies.
• Oct 14, 2025 — Windows 10 reaches end of support. Unenrolled devices stop receiving fixes.

Vulnerability records

• CVE-2024-30051 · KEV 2024-05-14 · Windows DWM Core Library Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Update Guide: CVE-2024-30051 msrc.microsoft.com
2. Microsoft — May 2024 Security Updates (CVRF) api.msrc.microsoft.com
3. CVE record — CVE-2024-30051 cve.org
4. NVD — CVE-2024-30051 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-30051 cisa.gov
6. Kaspersky Securelist — QakBot attacks with Windows zero-day (CVE-2024-30051) securelist.com
7. Microsoft Learn — Ending Support in 2025 learn.microsoft.com

Coverage and analysis

1. BleepingComputer — Microsoft May 2024 Patch Tuesday fixes 3 zero-days, 61 flaws bleepingcomputer.com