Cyber Resilience

CVE-2024-49117

Microsoft Windows 11 22H2 ≤ 10.0.22621.4602

Published
12 December 2024
Modified
14 January 2025
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.010 60th percentile
Risk Priority 63 floored blend · peak EPSS

Summary

CVE-2024-49117 is a high-severity Return of Wrong Status Code (CWE-393) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 40% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-6 (Security and Privacy Function Verification) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Windows Hyper-V Remote Code Execution Vulnerability

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-43625Same product: Microsoft Windows 11 22H2
CVE-2024-43642Same product: Microsoft Windows 11 22H2
CVE-2024-38264Same product: Microsoft Windows 11 22H2
CVE-2024-43631Same product: Microsoft Windows 11 22H2
CVE-2025-21224Same product: Microsoft Windows 11 22H2
CVE-2025-21235Same product: Microsoft Windows 11 22H2
CVE-2025-21275Same product: Microsoft Windows 11 22H2
CVE-2025-21234Same product: Microsoft Windows 11 22H2
CVE-2024-43533Same product: Microsoft Windows 11 22H2
CVE-2024-38259Same product: Microsoft Windows 11 22H2

Affected Assets

microsoft
windows 11 22h2
≤ 10.0.22621.4602
microsoft
windows 11 23h2
≤ 10.0.22631.4602
microsoft
windows 11 24h2
≤ 10.0.26100.2605
microsoft
windows server 2022
≤ 10.0.20348.2966
microsoft
windows server 2022 23h2
≤ 10.0.25398.1308
microsoft
windows server 2025
≤ 10.0.26100.2605

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation at post-design stages directly exercises code paths and can identify functions returning incorrect status codes.

Verification of correct security/privacy function operation will surface incorrect status codes that alter expected behavior.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices such as code review, unit testing, and static analysis directly prevent incorrect status codes from being returned.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect functions returning wrong status codes.

prevents

Secure development lifecycle includes code review and testing that can catch incorrect status codes.

prevents

Secure coding standards directly address proper return-value handling and error indication.

References