CVE-2023-24949
Published: 09 May 2023
Summary
CVE-2023-24949 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-24949 is a Windows Kernel elevation of privilege vulnerability that affects the core operating system component responsible for managing system resources and access controls. It carries a CVSS 3.1 base score of 7.8 and is associated with CWE-190 integer overflow or wraparound.
An attacker with low privileges and local access can exploit the flaw without user interaction to obtain full administrative control, resulting in complete compromise of confidentiality, integrity, and availability on the target system.
Microsoft's security update guide at the referenced MSRC advisory addresses patches and mitigation steps for this issue. The associated EPSS score remains low, with a current value of 0.0654 and a peak of 0.0790.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28936
Vulnerability details
Windows Kernel Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.