CVE-2024-38107

ENISA EUVD: EUVD-2024-37146 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 3 articles Published: 2024-08-13

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

3.35%

probability

This CVE has a 3.35% probability of being exploited in the next 30 days.

0% Top 87.5th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

NVD

Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

Affected Products

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows Server 2019

10.0.17763.0

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0

Microsoft

Windows Server 2022

10.0.20348.0

Microsoft

Windows 11 version 21H2

10.0.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.6189

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.7259

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.2655

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.4780

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22134

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.7259

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.1085

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.7259

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.20751

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.1457

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25031

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.6189

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.4037

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.4037

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.6189

Microsoft

Windows 11 version 21H2

10.0.0 <10.0.22000.3147

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.4037

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25031

Microsoft

Windows 10 Version 21H2

10.0.19043.0 <10.0.19044.4780

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22134

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-416 · Use After Free CWE-664 · Improper Control of a Resource Through its Lifetime CWE-666 · Operation on Resource in Wrong Phase of Lifetime CWE-672 · Operation on a Resource after Expiration or Release CWE-825 · Expired Pointer Dereference

Google Project Zero

Patched

Aug. 13, 2024

Reported by

Anonymous

Root Cause Analysis

???

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38107

vendor-advisory

Signal Intelligence

Confidenceⓘ

78%

EPSS 3.35%

CVSS v3.1 7.8

Mentions 3

Last Seen Aug 13, 2024

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

Analyst Note

CVE-2024-38107 is confirmed as a zero-day vulnerability affecting Windows 10 with a HIGH CVSS score of 7.8, reported by Google Project Zero and documented in Microsoft's August 2024 Patch Tuesday bulletin addressing 9 zero-days. The elevation of privilege nature and inclusion in a major vendor security update provides strong validation of the threat.

Triage Info

Decided atMar 03, 2026

Published DateAug 13, 2024