CVE-2024-21646

RCE in Microsoft Azure Uamqp ≤ 2024-01-01

RCE Memory Safety

Published

09 January 2024

Modified

17 June 2026

Patch / advisory

View advisory

CVSS Score v3.1 9.8

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.051 92th percentile

Risk Priority 78 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-21646 is a critical-severity Code Injection (CWE-94) vulnerability in Microsoft Azure Uamqp. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-19279

Vulnerability Data

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound…

or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.

CWE(s): CWE-94 CWE-190

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

attack.mitre.org →

T1001.003 Protocol or Service Impersonation Command And Control

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

attack.mitre.org →

T1003.004 LSA Secrets Credential Access

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.

attack.mitre.org →

T1003.005 Cached Domain Credentials Credential Access

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

attack.mitre.org →

T1003.006 DCSync Credential Access

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…

attack.mitre.org →

T1003.007 Proc Filesystem Credential Access

Adversaries may gather credentials from the proc filesystem or `/proc`.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-25110Same product: Microsoft Azure Uamqp

CVE-2024-21351Same vendor: Microsoft

CVE-2026-70338Same vendor: Microsoft

CVE-2026-41094Same vendor: Microsoft

CVE-2026-41134Same vendor: Microsoft

CVE-2026-45583Same vendor: Microsoft

CVE-2023-36575Same vendor: Microsoft

CVE-2025-21292Same vendor: Microsoft

CVE-2013-3906Same vendor: Microsoft

CVE-2014-4148Same vendor: Microsoft

Affected Assets

microsoft

azure uamqp

≤ 2024-01-01

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V5.2.6
V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation finds code paths that accept and execute externally influenced strings.

SI-10 Information Input Validation good match

Input validation directly stops untrusted data from being used to construct executable code without neutralization.

AC-6 Least Privilege partial match

Least privilege limits the damage an injected code fragment can perform once executed.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

blocks

PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).

PR.DS-10 none match

blocks

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match

removes

A.5.15 Access control partial match

removes

A.5.16 Identity management partial match

removes

A.5.17 Authentication information partial match

removes

A.5.18 Access rights partial match

removes

A.8.10 Information deletion partial match

removes