PT-2024-16675 · Velocidex · Velocidex Winpmem

Published 2024-12-16 · Updated 2025-09-05 · CVE-2024-10972

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Velocidex WinPmem versions 4.1 and below

Description The issue is due to improper input validation, allowing an attacker with admin access to trigger a BSOD by changing the memory's access rights under the control of the user-mode application. This is possible because verification is only performed at the beginning of the routine, enabling userspace to change page permissions halfway through the routine. A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.

Recommendations For Velocidex WinPmem versions 4.1 and below, upgrade to the latest release to secure your systems. As a temporary workaround, consider implementing a rule to detect unauthorized loading of winpmem outside incident response operations.

Fix

RCE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-20

CWE-367

Related Identifiers

CVE-2024-10972

Affected Products

Velocidex Winpmem

References · 8

• https://osv.dev/vulnerability/CVE-2024-10972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10972 · Security Note
• https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1 · Note
• https://t.me/cveNotify/134374 · Telegram Post
• https://twitter.com/transilienceai/status/1869612628802257069 · Twitter Post
• https://twitter.com/transilienceai/status/1869612621386613109 · Twitter Post
• https://twitter.com/cracbot/status/1870348535675384169 · Twitter Post
• https://twitter.com/CVEnew/status/1868676415496818891 · Twitter Post