Cyber Resilience

CVE-2024-38112

Microsoft Windows 10 1607 ≤ 10.0.14393.7159

CISA KEVActive ExploitationEUVD Exploited
Published
09 July 2024
Modified
28 October 2025
KEV Added
09 July 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.84 99.7th percentile
Risk Priority 82 floored blend · peak EPSS

Summary

CVE-2024-38112 is a high-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML Platform. It carries a CVSS 3.1 base score of 7.5 and is associated with CWE-451. The flaw was publicly disclosed on 9 July 2024 and affects the MSHTML rendering engine used by multiple Windows components.

An unauthenticated remote attacker can exploit the issue over the network, although successful exploitation requires high attack complexity and user interaction. When conditions are met, the attacker can achieve high impact on confidentiality, integrity, and availability by presenting spoofed content that may lead to further compromise.

Microsoft Security Response Center advisories provide patch information and mitigation guidance, while CISA has added the CVE to its catalog of known exploited vulnerabilities. The associated EPSS score remains elevated near 0.93, consistent with confirmed in-the-wild exploitation activity.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Windows MSHTML Platform Spoofing Vulnerability

CWE(s)
KEV Date Added
09 July 2024

Related Threats

MITRE ATT&CK Enterprise Techniques

T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
T1566.003 Spearphishing via Service Initial Access
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
T1598 Phishing for Information Reconnaissance
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.
T1598.003 Spearphishing Link Reconnaissance
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.
T1534 Internal Spearphishing Lateral Movement
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-43461Same product: Microsoft Windows 10 1507both on KEV
CVE-2025-21314Same product: Microsoft Windows 10 1607
CVE-2023-36424Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-26169Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-35250Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-29059Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38014Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38193Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38217Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-43572Same product: Microsoft Windows 10 1507both on KEV

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.20710
microsoft
windows 10 1607
≤ 10.0.14393.7159 · ≤ 10.0.14393.7159
microsoft
windows 10 1809
≤ 10.0.17763.6054 · ≤ 10.0.17763.6054
microsoft
windows 10 21h2
≤ 10.0.19044.4651
microsoft
windows 10 22h2
≤ 10.0.19045.4651
microsoft
windows 11 21h2
≤ 10.0.22000.3079
microsoft
windows 11 22h2
≤ 10.0.22621.3880
microsoft
windows 11 23h2
≤ 10.0.22631.3880
microsoft
windows server 2008
all versions
microsoft
windows server 2012
r2
+4 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly address design and implementation of accurate, non-spoofable UI elements.

PR.AT-01 partial match
prevents

User awareness training helps people recognize and avoid harm from UI misrepresentation such as phishing, but does not prevent the flaw itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect UI misrepresentation vulnerabilities before deployment.

prevents

Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.

mitigates

Web filtering can block known phishing sites that exploit UI misrepresentation.

prevents

Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.

prevents

Application security requirements can mandate proper display and validation of critical information in the UI.

prevents

Secure coding practices can prevent UI flaws that obscure or spoof critical information.

References