CVE-2024-38014
KEVMicrosoft Windows Installer Improper Privilege Management Vulnerability
Description
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
Windows Installer Elevation of Privilege Vulnerability
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedSep 10, 2024
Last modifiedAug 10, 2026
Added to KEVSep 10, 2024
Remediation dueOct 1, 2024
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014PatchVendor Advisory
- seclists.org/fulldisclosure/2024/Sep/43Mailing ListThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38014US Government Resource
0 recent articles mention this CVE
70
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 755 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 6.3% · top 6% of all CVEs
- Weakness
- CWE-269
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.