Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-30088 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-30088 is an elevation-of-privilege vulnerability in the Windows kernel, tracked under CWE-367 and carrying a CVSS 3.1 score of 7.0. The flaw resides in core kernel code and affects supported Windows versions that have not yet received the corresponding security update.
A local attacker with low privileges can exploit the race condition to elevate to SYSTEM-level access, obtaining full read, write, and execution rights on the target system. The attack requires no user interaction but is rated high complexity, limiting its feasibility to scenarios where the attacker already has code execution on the host.
Microsoft security updates address the issue by correcting the kernel race condition; organizations should apply the patches referenced in the Microsoft Security Response Center advisory. The vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
EPSS scores have remained consistently high, with a current value of 0.8808 and a recorded peak of 0.8948, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28025
Vulnerability Data
Windows Kernel Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 15 October 2024
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the Microsoft security updates that correct the kernel race condition in CVE-2024-30088.
Enforces least-privilege execution so a local attacker starts with minimal rights, reducing the ability to exploit the kernel race condition to SYSTEM.
Enforces access-control decisions on kernel objects and privileges, blocking unauthorized elevation even if the race condition is triggered.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.