CVE-2024-35250
published 2024-06-11CVE-2024-35250: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
PriorityP185high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-01-06
Exploited in the wild
EPSS
25.22%
97.7th percentile
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20680 | 10.0.10240.20680 |
| microsoft | windows_10_1607 | < 10.0.14393.7070 | 10.0.14393.7070 |
| microsoft | windows_10_1809 | < 10.0.17763.5936 | 10.0.17763.5936 |
| microsoft | windows_10_21h2 | < 10.0.19044.4529 | 10.0.19044.4529 |
| microsoft | windows_10_22h2 | < 10.0.19045.4529 | 10.0.19045.4529 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20680 | 10.0.10240.20680 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7070 | 10.0.14393.7070 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.5936 | 10.0.17763.5936 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.5936 | 10.0.17763.5936 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.4529 | 10.0.19044.4529 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.4529 | 10.0.19045.4529 |
| microsoft | windows_11_21h2 | < 10.0.22000.3019 | 10.0.22000.3019 |
| microsoft | windows_11_22h2 | < 10.0.22621.3737 | 10.0.22621.3737 |
| microsoft | windows_11_23h2 | < 10.0.22631.3737 | 10.0.22631.3737 |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.3019 | 10.0.22000.3019 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.3737 | 10.0.22621.3737 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.3737 | 10.0.22631.3737 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.3737 | 10.0.22631.3737 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27170 | 6.1.7601.27170 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22720 | 6.0.6003.22720 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24919 | 6.2.9200.24919 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22023 | 6.3.9600.22023 |
| microsoft | windows_server_2016 | < 10.0.14393.7070 | 10.0.14393.7070 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for local privilege escalation to SYSTEM via untrusted pointer dereference in the Microsoft Kernel Streaming Service (MSKSSRV.SYS / ks.sys) driver — exploitation requires no user interaction and is low complexity. ↗
- →A public Metasploit module exists for this vulnerability targeting Windows 10, Windows 11, and Windows Server 2022; hunt for execution of exploit modules referencing 'cve_2024_35250_ks_driver'. ↗
- →CVE-2024-35250 is confirmed actively exploited and listed in CISA KEV; prioritize detection of anomalous kernel-mode driver interactions with ks.sys/MSKSSRV.SYS on unpatched systems. ↗
- ·The Metasploit module targets Windows 10, Windows 11, and Windows Server 2022 specifically; the broader CVE patch scope covers a much wider range of Windows versions including Server 2008 through Server 2022 and Windows 10/11 variants. ↗
- ·Microsoft's advisory had not been updated to reflect active exploitation status at time of reporting, despite CISA adding it to the KEV catalog. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-98g3-x4rc-fj4g: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
ghsa_unreviewed·2024-06-11
CVE-2024-35250 [HIGH] CWE-119 GHSA-98g3-x4rc-fj4g: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
VulnCheck
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
vulncheck·2024·CVSS 7.8
CVE-2024-35250 [HIGH] CWE-822 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.crowdstrike.com/explore/2025-global-threat-report; https://securelist.com/vulnerabilities-and-exploits-in-q1-2025/116624/; https://ctrlaltint3l.github.io/threat%20research/china-vietnam-campaign/; https://securelist.com/vulnerabilities-and-exploits-in-q2-2025/117333/; https://www.crowdstrike.c
CISA
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
cisa·2024-12-16·CVSS 7.8
CVE-2024-35250 [HIGH] CWE-822 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
Vulnerability: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
Affected: Microsoft Windows
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250 ; https://nvd.nist.gov/vuln/detail/CVE-2024-35250
Remediation Due Date: 2025-01-06
Microsoft
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
vendor_msrc·2024-06-11·CVSS 7.8
CVE-2024-35250 [HIGH] CWE-822 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Windows Kernel-Mode Drivers: Windows Kernel-Mode Drivers
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039217
Reference: https://support.microsoft.com/help/5039217
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5039227
Reference: https://support.microsoft.com/help/5039227
Reference: https://catalog.upda
No detection rules found.
Securelist
Vulnerability landscape analysis for Q2 2025
blogs_securelist·2025-08-27
Vulnerability landscape analysis for Q2 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverage vulnerabilities in real-world attacks as a means of gaining access to user systems, just like in previous periods.
This report also describes known vulnerabilities used with popular C2 frameworks during the first half of 2025.
## Statistics on registered vulnera
Securelist
Vulnerability landscape analysis for Q1 2025
blogs_securelist·2025-05-30
Vulnerability landscape analysis for Q1 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
The first quarter of 2025 saw the continued publication of vulnerabilities discovered and fixed in 2024, as some researchers were previously unable to disclose the details. This partially shifted the focus away from vulnerabilities that received new CVE-2025-NNNNN identifiers. The nature of the CVE assignment process can result in a notable delay between problem investigation and patch release, which is mitigated by reserving a CVE ID early in the process. As for trends in vulnerability exploitation, we are seeing increasing rates of attacks targeting older operating syste
Bleepingcomputer
Windows kernel bug now exploited in attacks to gain SYSTEM privileges
blogs_bleepingcomputer·2024-12-16·CVSS 7.4
CVE-2024-35250 [HIGH] Windows kernel bug now exploited in attacks to gain SYSTEM privileges
## Windows kernel bug now exploited in attacks to gain SYSTEM privileges
## Sergiu Gatlan
CISA has warned U.S. federal agencies to secure their systems against ongoing attacks targeting a high-severity Windows kernel vulnerability.
Tracked as CVE-2024-35250, this security flaw is due to an untrusted pointer dereference weakness that allows local attackers to gain SYSTEM privileges in low-complexity attacks that don't require user interaction.
While Microsoft didn't share more details in a security advisory published in June, the DEVCORE Research Team that found the flaw and reported it to Microsoft through Trend Micro's Zero Day Initiative says the vulnerable system component is the Microsoft Kernel Streaming Service (MSKSSRV.SYS).
DEVCORE security researchers used this MSKSSRV privil
Trendmicro
The June 2024 Security Update Review
blogs_trendmicro·2024-06-11
The June 2024 Security Update Review
# The June 2024 Security Update Review
Get the June 2024 security update and review.
By: Dustin Childs
2024/06/11
Read time: ( words)
Save to Folio
Somehow, we’ve made it to the sixth patch Tuesday of 2024, and Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for June 2024
For June, Adobe released 10 patches addressing 165(!) CVEs in Adobe Cold Fusion, Photoshop, Experience Manager, Audition, Media Encoder, FrameMaker Publishing Server, Adobe Commerce, Substance 3D Stager, Creative Cloud Desktop, and Acrobat Android. The fix for Experience Ma
Qualys
Microsoft & Adobe June 2024 Patch Tuesday: Critical Updates & Fixes | Qualys
blogs_qualys·2024-06-11
Microsoft & Adobe June 2024 Patch Tuesday: Critical Updates & Fixes | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for June 2024
- Adobe Patches for June 2024
- Zero-day Vulnerability Patched in June Patch Tuesday Edition
- Critical Severity Vulnerability Patched in June Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
Microsoft’s June Patch Tuesday is here, bringing fixes for vulnerabilities impacting its multiple products. This month’s release highlights the ongoing battle against cybersecurity threats, from critical updates to important fixes. Let’s dive into the crucial
Qualys
Microsoft and Adobe Patch Tuesday, June 2024 Security Update Review
blogs_qualys·2024-06-11
Microsoft and Adobe Patch Tuesday, June 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for June 2024
Adobe Patches for June 2024
Zero-day Vulnerability Patched in June Patch Tuesday Edition
Critical Severity Vulnerability Patched in June Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
Microsoft’s June Patch Tuesday is here, bringing fixes for vulnerabilities impacting its multiple products. This month’s release highlights the ongoing battle against cybersecurity threats, from critical updates to important fixes. Let’s dive into the crucial insights fro
Talos
Only one critical issue disclosed as part of Microsoft Patch Tuesday
blogs_talos·2024-06-11·CVSS 8.0
CVE-2024-30080 [HIGH] Only one critical issue disclosed as part of Microsoft Patch Tuesday
Microsoft released its monthly security update Tuesday, disclosing 49 vulnerabilities across its suite of products and software.
Of those there is only one critical vulnerability. Every other security issues disclosed this month is considered "important."
The lone critical security issue is CVE-2024-30080, a remote code execution vulnerability due to a use-after-free (UAF) issue in the HTTP handling function of Microsoft Message Queuing (MSMQ) messages.
An adversary can send a specially crafted malicious MSMQ packet to an MSMQ server, potentially allowing them to perform remote code execution on the server side. Microsoft considers this vulnerability “more likely” to be exploited.
There is also a remote code execution vulnerability in Microsoft Outlook, CVE-2024-30103. By successfully
Trendmicro
The June 2024 Security Update Review
blogs_trendmicro·2024-06-11
The June 2024 Security Update Review
## The June 2024 Security Update Review
Get the June 2024 security update and review.
By: Dustin Childs 2024/06/11 Read time: ( words)
Save to Folio
Somehow, we’ve made it to the sixth patch Tuesday of 2024, and Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for June 2024
For June, Adobe released 10 patches addressing 165(!) CVEs in Adobe Cold Fusion, Photoshop, Experience Manager, Audition, Media Encoder, FrameMaker Publishing Server, Adobe Commerce, Substance 3D Stager, Creative Cloud Desktop, and Acrobat Android. The fix for Experience Ma
Talos
Only one critical issue disclosed as part of Microsoft Patch Tuesday
blogs_talos·2024-06-11·CVSS 8.0
CVE-2024-30080 [HIGH] Only one critical issue disclosed as part of Microsoft Patch Tuesday
## Only one critical issue disclosed as part of Microsoft Patch Tuesday
Microsoft released its monthly security update Tuesday, disclosing 49 vulnerabilities across its suite of products and software.
Of those there is only one critical vulnerability. Every other security issues disclosed this month is considered "important."
The lone critical security issue is CVE-2024-30080 , a remote code execution vulnerability due to a use-after-free (UAF) issue in the HTTP handling function of Microsoft Message Queuing (MSMQ) messages.
An adversary can send a specially crafted malicious MSMQ packet to an MSMQ server, potentially allowing them to perform remote code execution on the server side. Microsoft considers this vulnerability “more likely” to be exploited.
There is also a remote code exec
Zscaler
Zscaler protects against 5 new vulnerabilities | 06-11-2024
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler protects against 5 new vulnerabilities | 06-11-2024
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
2024-06-11
Published
2024-12-16
Added to CISA KEV
Exploited in the wild