CVE-2024-35250
Published: 11 June 2024
Summary
CVE-2024-35250 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-35250 is an elevation of privilege vulnerability in the Windows Kernel-Mode Driver. It carries a CVSS 3.1 score of 7.8 and is associated with CWE-822. The flaw affects the Windows kernel component and permits an attacker to escalate privileges on a local system.
An attacker with low privileges and local access can exploit the issue without user interaction. Successful exploitation grants full control over confidentiality, integrity, and availability, allowing the attacker to obtain SYSTEM-level rights on the affected host.
Microsoft security advisories at msrc.microsoft.com recommend applying the vendor-supplied updates to remediate the flaw. CISA has added CVE-2024-35250 to its Known Exploited Vulnerabilities catalog, confirming that the vulnerability is under active exploitation and directing organizations to prioritize patching.
EPSS scores for this CVE reached a peak of 0.6351 and remain elevated at 0.5491, indicating that exploitation interest increased after disclosure and that the issue continues to warrant attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-35761
Vulnerability details
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 16 December 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches to eliminate the kernel-mode EoP flaw before local attackers can exploit it.
Enforces least privilege so that low-privileged local accounts cannot reach the kernel driver code path used for escalation.
Enforces access-control decisions on kernel objects and processes, limiting the ability of an authenticated user to abuse the vulnerable driver.