CVE-2024-26183
Published: 09 April 2024
Summary
CVE-2024-26183 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Kerberos is affected by a denial of service vulnerability tracked as CVE-2024-26183. The flaw carries a CVSS 3.1 base score of 6.5 and is associated with CWE-476, indicating a null pointer dereference that an attacker can trigger to disrupt service availability while leaving confidentiality and integrity untouched.
An authenticated user with low privileges can exploit the issue remotely over the network without user interaction. Successful exploitation results in a high-impact denial of service against the Kerberos service, preventing legitimate authentication requests from being processed.
Microsoft has published guidance for the vulnerability in its security update guide at the listed MSRC URLs, including details on available patches and mitigation steps for supported Windows releases. The EPSS score has remained flat at 0.1406 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23459
Vulnerability details
Windows Kerberos Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.