CVE-2024-21412
Published: 13 February 2024
Summary
CVE-2024-21412 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2024-21412 is a security feature bypass vulnerability affecting the handling of Internet Shortcut Files. The flaw carries a CVSS 3.1 score of 8.1 and is associated with CWE-693. It was publicly disclosed on 13 February 2024 and impacts components responsible for processing .url files within Microsoft environments.
An unauthenticated remote attacker can exploit the issue by supplying a malicious Internet Shortcut File over the network. Successful exploitation requires the victim to interact with the file, after which the bypass allows high-impact effects on confidentiality and integrity while leaving availability unaffected.
Microsoft’s advisory at msrc.microsoft.com details the available patches and configuration guidance, while CISA has added the CVE to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The associated EPSS score remains consistently high, with a current value of 0.9377 and a peak of 0.9378.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19121
Vulnerability details
Internet Shortcut Files Security Feature Bypass Vulnerability
- CWE(s)
- KEV Date Added
- 13 February 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks or quarantines malicious Internet shortcut files before they can be processed or executed by the system.
Restricts automatic execution and user-prompted invocation of mobile code delivered via shortcut files, closing the bypass vector.
Enforces information-flow policies that can deny or sanitize shortcut files attempting to circumvent security-feature checks.