CVE-2024-38025

Deeper analysis

Microsoft Windows Performance Data Helper Library contains a remote code execution vulnerability tracked as CVE-2024-38025. The flaw is present in a core Windows component responsible for collecting and exposing performance metrics and is characterized by the CWEs for heap-based buffer overflows and out-of-bounds writes. It received a CVSS 3.1 base score of 7.2 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges can send specially crafted network requests to trigger the flaw and execute arbitrary code on the target system without user interaction. Successful exploitation grants the attacker the ability to fully compromise the affected Windows host, including reading or modifying sensitive data and installing persistent malware.

Microsoft has published an advisory for CVE-2024-38025 on its Security Response Center site that details available patches and remediation steps for supported Windows versions. The EPSS score reached a modest peak of 0.0652 several months after disclosure before receding to its current value of 0.0477.