CVE-2024-38106
ENISA EUVD: EUVD-2024-37137 ↗
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: March 3, 2026
4 articles
Published: 2024-08-13
EPSS Score
Source: FIRST.org · 2026-05-23
0.75%
probability
This CVE has a 0.75% probability
of being exploited in the next 30 days.
0%
Top 73.4th percentile of all CVEs
100%
CVSS v3.1
Source: VulnerabilityLookup (CIRCL)7
HIGH
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Temporal
Exploit Code Maturity
Functional
Remediation Level
Official Fix
Report Confidence
Confirmed
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Description
NVDWindows Kernel Elevation of Privilege Vulnerability
Affected Products
Microsoft
Windows 10 Version 1809
10.0.17763.0
Microsoft
Windows Server 2019
10.0.17763.0
Microsoft
Windows Server 2019 (Server Core installation)
10.0.17763.0
Microsoft
Windows Server 2022
10.0.20348.0
Microsoft
Windows 11 version 21H2
10.0.0
Attack Intelligence
Google Project Zero
Patched
Aug. 13, 2024
Reported by
Anonymous
Root Cause Analysis
???
Signal Intelligence
Confidence
87%
EPSS
0.75%
CVSS v3.1
7
Mentions
4
Last Seen
Aug 30, 2024
CNA Information
CNA Assigner
microsoft
CNA Title
Windows Kernel Elevation of Privilege Vulnerability
Analyst Note
This Windows Kernel elevation of privilege vulnerability is confirmed as a zero-day with HIGH severity (CVSS 7.0), included in Microsoft's August 2024 Patch Tuesday addressing 9 zero-days, and documented by Google Project Zero. The vulnerability has demonstrated real-world exploitation potential and established credible reporting from security researchers.
Threat Actors 1
Lazarus Group
apt_group
Information theft and espionage
🇰🇵 KP
Triage Info
Decided atMar 03, 2026
Published DateAug 13, 2024