Analysis Summary

CVE-2024-30040 CVSS:8.8

Microsoft Windows could allow a remote attacker to bypass security restrictions, caused by improper input validation in MSHTML Platform. By persuading a victim to open a specially crafted document, an attacker could exploit this vulnerability to bypass OLE mitigations in Microsoft 365 and Microsoft Office and execute arbitrary code on the system.

CVE-2024-30051 CVSS:7.8

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a heap-based buffer overflow in the DWM Core Library component. By sending a specially crafted request, an attacker could exploit this vulnerability to gain SYSTEM privileges.

Impact

• Security Bypass
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2024-30040
• CVE-2024-30051

Affected Vendors

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.

CVE-2024-30040

CVE-2024-30051