Every CVESearch/Get API key

CVE-2024-21338

Windows Kernel Elevation of Privilege Vulnerability

7.8 HighIn KEVPublic exploit

CVE-2024-21338 is a high vulnerability (CVSS 7.8) in Microsoft Windows, published February 13, 2024. CISA lists it as known to be exploited, since March 4, 2024. EUVD reports exploitation since March 4, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 62.2%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
7.8 HighCVSS 3.1, CVE List
Exploit chance
62.2%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

Windows Kernel Elevation of Privilege Vulnerability

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

62.2%Up 62.2 points since Feb 14, 2024
90%50%10%1%

Affected products

Show 7 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMicrosoft Windows 10.0.17763.5458 - Kernel Privilege Escalation2024-04-02
PoC in GitHubhakaioffsec/CVE-2024-213382024-04-13
PoC in GitHubUMU618/CVE-2024-213382024-04-17
PoC in GitHubwusijie/CVE-2024-21338-12024-05-05
PoC in GitHubZombie-Kaiser/CVE-2024-21338-x64-build-2024-05-18
PoC in GitHubtykawaii98/CVE-2024-21338_PoC2024-06-23
PoC in GitHubCrowdfense/CVE-2024-213382024-07-29
PoC in GitHubhackyboiz/kcfg-bypass2025-01-12
Exploit-DBMicrosoft Windows 11 - Kernel Privilege Escalation2025-04-22
PoC in GitHubMistyFir/CVE-2024-21338-Exploit2026-03-11

What each source reports

CVE List Score used7.8

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Record
CVE-2024-21338
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Weakness
CWE-822
Updated
2026-11-02
EUVDEUVD-2024-190507.8

Windows Kernel Elevation of Privilege Vulnerability

Record
EUVD-2024-19050
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-jqrq-gqwg-r8r57.8

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Record
GHSA-jqrq-gqwg-r8r5
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-822
Updated
2026-11-02
CISA KEVNo score

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Record
CVE-2024-21338
Weakness
CWE-822
Updated
2026-11-02
NVD7.8

Windows Kernel Elevation of Privilege Vulnerability

Record
CVE-2024-21338
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-822
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open