CVE-2024-43532
Microsoft Windows 10 21H2 ≤ 10.0.19044.5011
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-43532 is a high-severity Failing Open (CWE-636) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-43532 is an elevation of privilege vulnerability in the Remote Registry Service, a component that permits remote management of the Windows registry. The flaw received a CVSS 3.1 score of 8.8 and is tracked under CWE-636. It was publicly disclosed on 8 October 2024.
An attacker with low-privileged network access can exploit the issue without user interaction to obtain full control over confidentiality, integrity, and availability on the affected system. The attack vector is rated as network-reachable with low attack complexity, allowing an authenticated remote user to escalate to high privileges.
The sole reference points to the Microsoft Security Response Center advisory, which is the authoritative source for patch availability and mitigation guidance. The EPSS score has remained flat at 0.6141 since disclosure, indicating steady but not sharply increasing exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40657
Vulnerability Data
Remote Registry Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.2.1V7.4.1V8.3.3V10.3.4
Mitigating Controls (NIST 800-53 r5) AI
SC-24 directly requires the system to fail to a known state that preserves security properties, structurally stopping fallback to a less-secure mode.
SI-17 mandates explicit fail-safe procedures that activate on indicated failures, preventing the insecure fallback behavior.
CP-12 forces entry into a safe mode on detected conditions, limiting exposure but not covering every failure path.
SA-8 requires application of engineering principles that include fail-secure design, reducing the likelihood the weakness is introduced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices explicitly include designing error and failure handling to remain in a secure state.
Least-privilege policy and enforcement directly counters the permissive-access fallback example in the CWE.
Hardened baselines and configuration management reduce the chance that error paths default to insecure settings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control forces an explicit evaluation step before any response, reducing the chance that a failure condition will default to an unsafe open state.