CVE-2024-21302 · Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Summary: As of July 10, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this vulnerability. An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. Update: July 10, 2025 Microsoft has addressed this vulnerability for Windows 10 1507, Windows 10, version 1607, Windows 10, version 1809, and Windows Server 2016 and Windows Server 2018. This ensures that mitigations are available to protect all supported versions of Windows 10 and Windows 11 from this vulnerability. See the available mitigations and deployment guidelines described in KB5042562: Guid...

Severity

Important

Impact

Elevation of Privilege

CVSS

6.7 base · 5.8 temporal

Release

2024-08-07

Signals

Windows Secure Kernel Mode Elevation of Privilege Exploited: No Publicly disclosed: Yes Exploitability: Exploitation Less Likely

CWE

CWE-284: Improper Access Control

Patch Diff

Loading module diff metadata...

Resolved binary override

Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.

Old version New version

Description

FAQ / Articles

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

MSRC Fields

Module / Tag

Windows Secure Kernel Mode

Release number

2024-Aug

Latest revision

2025-07-10

CNA

Microsoft

Customer action

required

Denial of service

N/A

CVSS Vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References

MSRC

Official detail

CVE Record

CVE.org

Revision History

v1 · 2024-08-07

Information published.

v1.1 · 2024-08-08

Added the Details, Recommended Actions, and Detections sections in the CVE Executive Summary because these were omitted when the CVE was initially published.

v3.1 · 2025-05-21

Updated the build numbers. This is an informational update only.

v2 · 2024-08-13

Microsoft has released the August 2024 security updates that include an opt-in mitigation available as an interim solution to help protect customers concerned about this vulnerability until the final mitigation is available in a security update. For more information, please see KB5042562: Guidance for blocking rollback of virtualization-based security related updates.

v3 · 2025-04-15

To comprehensively address CVE-2024-21302, Microsoft has released April 2025 security updates for all supported editions of Windows. Microsoft recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

v4 · 2025-07-10

Microsoft has released July 8, 2025 security updates for Windows 10 1507, Windows 10, version 1607, Windows 10, version 1809, and Windows Server 2016 and Windows Server 2018 that provide mitigations to protect these versions of Windows from this vulnerability. This ensures that mitigations are available to protect all supported versions of Windows 10 and Windows 11 from this vulnerability. See the available mitigations and deployment guidelines described in KB5042562: Guidance for blocking rollback of virtualization-based security related updates.