⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2024-11-05.

CVE-2024-30088 — Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft Windows 10 Version 1507

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition29 documents14 sources
Severity
7.0HIGHNVD
EPSS
84.8%
top 0.66%
CISA KEV
KEVRansomware
Added 2024-10-15
Due 2024-11-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
21
Microsoft Windows 10 Version 1507Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1809+18 more
Timeline
PublishedJun 11
KEV addedOct 15
KEV dueNov 5
Latest updateMar 17
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Windows Kernel Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages21 packages

▶NVDmicrosoft/windows< 10.0.14393.7070+3
▶NVDmicrosoft/windows_10_1507< 10.0.10240.20680
▶NVDmicrosoft/windows_10_1607< 10.0.14393.7070
▶NVDmicrosoft/windows_10_1809< 10.0.17763.5936
▶NVDmicrosoft/windows_10_21h2< 10.0.19044.4529

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-h47v-33fm-j33g: Windows Kernel Elevation of Privilege Vulnerability↗2024-06-11
▶
CVEList
Windows Kernel Elevation of Privilege Vulnerability↗2024-06-11
▶
VulnCheck
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability↗2024
▶

💥Exploits & PoCs

1
Metasploit
Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes↗
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability↗2024-10-15
▶
Microsoft
Windows Kernel Elevation of Privilege Vulnerability↗2024-06-11
▶

🕵️Threat Intelligence

22
Tenable
Operation Epic Fury: Why exposure data changes everything about Iran's cyber-kinetic campaign↗2026-03-17
▶
Tenable
Operation Epic Fury: cyber threat data in the Iran War↗2026-03-17
▶
Tenable
CVE-2026-21514 FAQ: OLE bypass N-Day in Microsoft Word | Tenable®↗2026-03-17
▶
Tenable
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word↗2026-03-17
▶
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates↗2026-02-02
▶
CVE-2024-30088 — Microsoft vulnerability | cvebase