CVE-2024-43565
Published: 08 October 2024
Summary
CVE-2024-43565 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-43565 is a denial-of-service vulnerability in the Windows Network Address Translation (NAT) component. It is rated 7.5 under CVSS 3.1 with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and is linked to CWE-125. The flaw permits remote, unauthenticated triggering of conditions that disrupt NAT processing.
An attacker with network reachability can send crafted traffic to induce a crash or resource exhaustion in the affected NAT implementation, producing a high availability impact while leaving confidentiality and integrity untouched. No user interaction or credentials are required, making the attack surface any Windows system exposing NAT functionality to untrusted networks.
Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43565 supplies remediation guidance and patch availability. The associated EPSS score remains flat at 0.0855 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40321
Vulnerability details
Windows Network Address Translation (NAT) Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.