CVE-2024-43532
Published: 08 October 2024
Summary
CVE-2024-43532 is a high-severity Failing Open (CWE-636) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-43532 is an elevation of privilege vulnerability in the Remote Registry Service, a component that permits remote management of the Windows registry. The flaw received a CVSS 3.1 score of 8.8 and is tracked under CWE-636. It was publicly disclosed on 8 October 2024.
An attacker with low-privileged network access can exploit the issue without user interaction to obtain full control over confidentiality, integrity, and availability on the affected system. The attack vector is rated as network-reachable with low attack complexity, allowing an authenticated remote user to escalate to high privileges.
The sole reference points to the Microsoft Security Response Center advisory, which is the authoritative source for patch availability and mitigation guidance. The EPSS score has remained flat at 0.6141 since disclosure, indicating steady but not sharply increasing exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40657
Vulnerability details
Remote Registry Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures audit logging continues on primary failure instead of failing open with no logging capability.
Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it.
Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state.
Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails.
Fail-safe-defaults principle prevents systems from failing open.
Directly requires transition to a known (secure) state on failure, preventing fail-open behavior.
Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open.
Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state.