CVE-2024-21411
Published: 12 March 2024
Summary
CVE-2024-21411 is a high-severity Insecure Default Variable Initialization (CWE-453) vulnerability in Skype Skype. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-21411 is a remote code execution vulnerability in Skype for Consumer that carries a CVSS 3.1 score of 8.8. The flaw is tracked under CWE-453 and was published on 12 March 2024.
An unauthenticated attacker can exploit the issue over the network with low complexity and only user interaction required, resulting in full impact to confidentiality, integrity, and availability on the affected system.
Microsoft publishes mitigation guidance for the vulnerability in its Security Response Center advisory at the listed reference URL. The current EPSS score stands at 0.0504 with an identical peak value, indicating no material rise in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19120
Vulnerability details
Skype for Consumer Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.