CVE-2024-49138

ENISA EUVD: EUVD-2024-43765 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 4 articles Published: 2024-12-10

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

85.84%

probability

This CVE has a 85.84% probability of being exploited in the next 30 days.

0% Top 99.4th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Unproven

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

NVD

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected Products

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows Server 2019

10.0.17763.0

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0

Microsoft

Windows Server 2022

10.0.20348.0

Microsoft

Windows 10 Version 21H2

10.0.19043.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.1.7601.0 <6.1.7601.27467

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.2605

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.7606

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.7606

Microsoft

Windows 10 Version 21H2

10.0.19043.0 <10.0.19044.5247

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.2605

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25222

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.6659

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.7606

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22318

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.7601.0 <6.1.7601.27467

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25222

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.4602

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.4602

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22318

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23016

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.6659

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.2605

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.2966

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.1308

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.6659

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23016

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.20857

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.6003.0 <6.0.6003.23016

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.5247

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.4602

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-122 · Heap-based Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write CWE-788 · Access of Memory Past End of Buffer

Google Project Zero

Patched

Dec. 10, 2024

Reported by

Advanced Research Team with CrowdStrike

Root Cause Analysis

???

Exploits & PoC

MrAle98/CVE-2024-49138-POC

POC exploit for CVE-2024-49138

269 2025-02-14

Zedocun/soc-investigation-powershell-edrfreeze

SOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated environm

1 2026-03-09

bananoname/CVE-2024-49138-POC

0 2025-01-21

DeividasTerechovas/SOC335-CVE-2024-49138-Exploitation-Detected

0 2025-03-14

CyprianAtsyor/letsdefend-cve-2024-49138-investigation

Hands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.

0 2025-04-23

Bridg3Ops/SOC335-CVE-2024-49138-Exploitation-Detected

0 2025-11-28

onixgod/SOC335-Event-ID-313-CVE-2024-49138-Exploitation-Detected--Lest-Defend-Writeup

In this lab I walked through an end-to-end intrusion that began with an external RDP break-in, used a brand-new CLFS privilege-escalation exploit (CVE

0 2025-06-12

vettrivel007/CVE-2024-49138

0 2026-04-04

8 repos — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138

vendor-advisory

Signal Intelligence

Confidenceⓘ

82%

EPSS 85.84%

CVSS v3.1 7.8

Mentions 4

Last Seen Dec 10, 2024

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Analyst Note

CVE-2024-49138 is confirmed as an elevation of privilege vulnerability in Windows CLFS driver with a HIGH CVSS score (7.8), reported by Google Project Zero, and addressed in Microsoft's December 2024 Patch Tuesday. The vulnerability's confirmation by a reputable security researcher group and its inclusion in official patch releases provide strong evidence supporting the CONFIRMED status, though the lack of CISA KEV listing suggests limited evidence of active exploitation at the time of assessment.