How to fix the zero-day CVE-2024-30051 in Windows DWM

Microsoft recently addressed CVE-2024-30051, a critical zero-day vulnerability in the Windows Desktop Window Manager (DWM) Core Library.

Here are the current technical details of this vulnerability, its impact, and the necessary actions to mitigate the risks associated with it.

What is CVE-2024-30051?

Uncovered during an investigation into another DWM-related zero-day exploit by researchers at Kaspersky, CVE-2024-30051 is a high-severity elevation of privilege vulnerability affecting the Windows Desktop Window Manager (DWM) Core Library. It is caused by a heap-based buffer overflow within the library, allowing attackers to escalate their privileges to SYSTEM level on vulnerable Windows systems, including Windows 10 and above, as well as Windows Server 2016 and later versions. 

Even though the patch became available yesterday (May 15th), Kaspersky’s monitoring uncovered ongoing exploitation of the vulnerability alongside QakBot and other malware, indicating that multiple threat actors had obtained access to the exploit. 

Does CVE-2024-30051 affect me?

CVE-2024-30051 poses a significant risk to users of vulnerable Windows systems. The vulnerability’s impact spans confidentiality, integrity, and availability, with a CVSS:3.1 score of 7.8 (High). However, it requires local access to the system for exploitation, which limits its attack vector. Here are the Product Status specifications: 

Has CVE-2024-30051 been actively exploited in the wild?

Yes, CVE-2024-30051 has been actively exploited in attacks, particularly by threat actors delivering QakBot malware payloads (among others). The exploit allows attackers to gain SYSTEM-level privileges, enabling them to execute arbitrary code and carry out malicious activities without user interaction.

How to fix CVE-2024-30051

Microsoft has released patches addressing CVE-2024-30051 as part of its recent Patch Tuesday updates. Organizations and users are strongly advised to apply these patches immediately to protect their systems from potential exploitation and mitigate the risks associated with this zero-day vulnerability. 

Next steps

Each new vulnerability is a reminder of where we stand and what we need to do better. Check out the following resources to help you maintain cyber hygiene and stay ahead of the threat actors: 

1. 2023 Vulnerability watch reports 
2. The MITRE ATT&CK framework: Getting started
3. The true impact of exploitable vulnerabilities for 2024
4. Multi-cloud security challenges – a best practice guide
5. How to properly tackle zero-day threats