Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-30088 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-30088 is an elevation-of-privilege vulnerability in the Windows kernel, tracked under CWE-367 and carrying a CVSS 3.1 score of 7.0. The flaw resides in core kernel code and affects supported Windows versions that have not yet received the corresponding security update.
A local attacker with low privileges can exploit the race condition to elevate to SYSTEM-level access, obtaining full read, write, and execution rights on the target system. The attack requires no user interaction but is rated high complexity, limiting its feasibility to scenarios where the attacker already has code execution on the host.
Microsoft security updates address the issue by correcting the kernel race condition; organizations should apply the patches referenced in the Microsoft Security Response Center advisory. The vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
EPSS scores have remained consistently high, with a current value of 0.8808 and a recorded peak of 0.8948, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28025
Vulnerability Data
Windows Kernel Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 15 October 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Process isolation limits the blast radius of a successful TOCTOU exploitation but does not remove the race itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.