CVE-2024-38112
Published: 09 July 2024
Summary
CVE-2024-38112 is a high-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-4 (System Monitoring).
Deeper analysis
CVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML Platform. It carries a CVSS 3.1 base score of 7.5 and is associated with CWE-451. The flaw was publicly disclosed on 9 July 2024 and affects the MSHTML rendering engine used by multiple Windows components.
An unauthenticated remote attacker can exploit the issue over the network, although successful exploitation requires high attack complexity and user interaction. When conditions are met, the attacker can achieve high impact on confidentiality, integrity, and availability by presenting spoofed content that may lead to further compromise.
Microsoft Security Response Center advisories provide patch information and mitigation guidance, while CISA has added the CVE to its catalog of known exploited vulnerabilities. The associated EPSS score remains elevated near 0.93, consistent with confirmed in-the-wild exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37791
Vulnerability details
Windows MSHTML Platform Spoofing Vulnerability
- CWE(s)
- KEV Date Added
- 09 July 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of Microsoft security updates that remediate the MSHTML spoofing flaw.
Verifies integrity of system components and rendered content to detect unauthorized modifications that enable spoofing.
Monitors for anomalous MSHTML behavior or exploitation attempts associated with this known in-the-wild spoofing attack.