CVE-2024-49138
Published: 12 December 2024
Summary
CVE-2024-49138 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-49138 is an elevation of privilege vulnerability in the Windows Common Log File System Driver. It carries a CVSS 3.1 score of 7.8 and is associated with CWE-122, indicating a likely heap-based buffer overflow that allows an attacker to corrupt memory and escalate privileges on an affected system.
A local attacker with low privileges can exploit the flaw without user interaction to obtain full control over the target Windows system, compromising confidentiality, integrity, and availability. Public exploit code has been published on Exploit-DB and PacketStorm, confirming the attack path is practical for anyone with local access.
Microsoft's advisory at msrc.microsoft.com details the issue and available patches, while CISA has added CVE-2024-49138 to its Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation. The EPSS score has reached a peak of 0.8744 with a current value of 0.8695, reflecting sustained and substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43765
Vulnerability details
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 10 December 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the Microsoft patch that eliminates the CLFS driver EoP flaw before exploitation.
Enforces least-privilege execution so a low-privileged local account cannot reach or abuse the vulnerable CLFS driver code paths.
Requires validation of all inputs to the CLFS driver, blocking the heap-overflow condition (CWE-122) that enables privilege escalation.