Cyber Resilience

CVE-2024-43461

Microsoft Windows 10 22H2 ≤ 10.0.19045.4894

CISA KEVActive ExploitationEUVD Exploited
Published
10 September 2024
Modified
10 August 2026
KEV Added
16 September 2024
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.52 99th percentile
Risk Priority 90 floored blend · peak EPSS

Summary

CVE-2024-43461 is a high-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Windows 10 22H2. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML Platform that carries a CVSS 3.1 score of 8.8. The flaw is tracked under CWE-451 and affects the MSHTML rendering engine used by multiple Windows components for processing web content.

An unauthenticated remote attacker can exploit the issue by serving specially crafted content that a user must interact with, such as through a web browser or application embedding MSHTML. Successful exploitation allows the attacker to spoof user interface elements, potentially leading to high impacts on confidentiality, integrity, and availability.

Microsoft’s advisory at msrc.microsoft.com details available patches, while CISA lists the CVE in its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild and requiring prioritized remediation.

EPSS for the vulnerability rose from a low baseline after disclosure to a peak of 0.1624 on 2024-09-18 before receding to the current value of 0.0990, indicating a measurable increase in observed exploitation interest following public release.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Windows MSHTML Platform Spoofing Vulnerability

CWE(s)
KEV Date Added
16 September 2024

Related Threats

MITRE ATT&CK Enterprise Techniques

T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
T1566.003 Spearphishing via Service Initial Access
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
T1598 Phishing for Information Reconnaissance
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.
T1598.003 Spearphishing Link Reconnaissance
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.
T1534 Internal Spearphishing Lateral Movement
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-38112Same product: Microsoft Windows 10 1507both on KEV
CVE-2025-21314Same product: Microsoft Windows 10 1607
CVE-2024-38014Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38193Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38217Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-43572Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38178Same product: Microsoft Windows 10 1507both on KEV
CVE-2023-36424Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-26169Same product: Microsoft Windows 10 1507both on KEV
CVE-2024-38107Same product: Microsoft Windows 10 1507both on KEV

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.20766 · ≤ 10.0.10240.20766
microsoft
windows 10 1607
≤ 10.0.14393.7336 · ≤ 10.0.14393.7336
microsoft
windows 10 1809
≤ 10.0.17763.6293
microsoft
windows 10 21h2
≤ 10.0.19044.4894
microsoft
windows 10 22h2
≤ 10.0.19045.4894 · ≤ 10.0.19045.4894 · ≤ 10.0.19045.4894
microsoft
windows 11 21h2
≤ 10.0.22000.3197
microsoft
windows 11 22h2
≤ 10.0.22621.4169
microsoft
windows 11 23h2
≤ 10.0.22621.4169 · ≤ 10.0.22631.4169
microsoft
windows 11 24h2
≤ 10.0.26100.1742
microsoft
windows server 2008
all versions, r2
+5 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly address design and implementation of accurate, non-spoofable UI elements.

PR.AT-01 partial match
prevents

User awareness training helps people recognize and avoid harm from UI misrepresentation such as phishing, but does not prevent the flaw itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect UI misrepresentation vulnerabilities before deployment.

prevents

Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.

mitigates

Web filtering can block known phishing sites that exploit UI misrepresentation.

prevents

Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.

prevents

Application security requirements can mandate proper display and validation of critical information in the UI.

prevents

Secure coding practices can prevent UI flaws that obscure or spoof critical information.

References