CVE-2024-43521
Microsoft Windows Server 2012 r2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-43521 is a high-severity Incorrect Check of Function Return Value (CWE-253) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 17% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Windows Hyper-V contains a denial of service vulnerability tracked as CVE-2024-43521. The flaw received a CVSS 3.1 base score of 7.5 and is associated with CWE-253. It affects the Hyper-V hypervisor component in supported Windows releases and allows remote interference with availability while leaving confidentiality and integrity untouched.
An unauthenticated attacker can exploit the issue over the network with low complexity and no user interaction. Successful exploitation results in a high-impact denial of service against the Hyper-V host, causing the affected virtualization service to become unavailable.
Microsoft has published an advisory for CVE-2024-43521 that includes remediation guidance and is available at the Microsoft Security Response Center. The EPSS score for the vulnerability has remained flat at 0.0790 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40775
Vulnerability Data
Windows Hyper-V Denial of Service Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can discover missing or incorrect return-value checks.
Documented development standards and tools can mandate verified checking of every function return value.
Security engineering principles include requirements for robust error checking of all function returns.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper error-handling and return-value checking during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect return-value checks.
Secure SDLC mandates return-value checks and error handling, directly reducing CWE-253.
Application security requirements include robust error handling that mitigates incorrect return-value checks.
Secure architecture principles require defensive coding practices such as validating function results.
Secure coding explicitly demands checking return values, covering most of CWE-253.