7.8

CVE-2024-21338: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

KEVRansomware
Analyzed
Published 13-02-2024Last modified 10-08-2026

Vulnerability summary

CVE-2024-21338 is a high (CVSS 7.8) Untrusted Pointer Dereference vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 04-03-2024. It has been used in ransomware campaigns. EPSS estimates a 59.81% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
59.81%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits4reference, exploit-database

Timeline

  1. 13-02-2024
    PublishedVulnerability first disclosed.
  2. 04-03-2024
    Added to CISA KEVExploitedMicrosoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
  3. 25-03-2024
    CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 10-08-2026
    Last modifiedVulnerability information updated.

Description

Windows Kernel Elevation of Privilege Vulnerability

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

59.81%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 59.81% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
04-03-2024
Federal due date
25-03-2024
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338 nvd.nist.gov/vuln/detail/CVE-2024-21338

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (packetstorm.news)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (decoded.avast.io)

    Maturity: unknown

  • exploit-databaselocalwindowsUnverified

    Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation

    Maturity: poc

Show all 4 exploits
  • exploit-databaselocalwindowsUnverified

    Microsoft Windows 11 - Kernel Privilege Escalation

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Microsoft18 products

1 vendor · 18 products

References

5 links