CVE-2024-49138

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 4 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

85.84%

probability

This CVE has a 85.84% probability of being exploited in the next 30 days.

0% Top 99.4th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-122 · Heap-based Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write CWE-788 · Access of Memory Past End of Buffer

Google Project Zero

Patched

Dec. 10, 2024

Reported by

Advanced Research Team with CrowdStrike

Root Cause Analysis

???

Exploits & PoC

MrAle98/CVE-2024-49138-POC

POC exploit for CVE-2024-49138

268

bananoname/CVE-2024-49138-POC

PoC CVE-2024-49138 — bananoname/CVE-2024-49138-POC

vettrivel007/CVE-2024-49138

PoC CVE-2024-49138 — vettrivel007/CVE-2024-49138

3 repos — triés par ⭐ Rechercher sur GitHub ↗

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability

TheHackerNews

Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability

TheHackerNews

Microsoft and Adobe Patch Tuesday, December 2024 Security Update Review

Qualys Dec 10, 2024

Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, 71 flaws

BleepingComputer Dec 10, 2024

Signal Intelligence

Confidenceⓘ

82%

EPSS 85.84%

Mentions 4

Last Seen Dec 10, 2024

CNA Information

Analyst Note

CVE-2024-49138 is confirmed as an elevation of privilege vulnerability in Windows CLFS driver with a HIGH CVSS score (7.8), reported by Google Project Zero, and addressed in Microsoft's December 2024 Patch Tuesday. The vulnerability's confirmation by a reputable security researcher group and its inclusion in official patch releases provide strong evidence supporting the CONFIRMED status, though the lack of CISA KEV listing suggests limited evidence of active exploitation at the time of assessment.