PT-2024-4855 · Microsoft · Windows

Tomer Peled · Published 2024-07-09 · Updated 2025-08-18 · CVE-2024-38030

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Windows versions 7 through 11 (affected versions not specified)

Description: A spoofing vulnerability exists within the Windows Themes component, potentially allowing attackers to steal NTLM credentials. The vulnerability is related to the handling of file paths to image resources, specifically BrandImage or Wallpaper, within theme files. Exploitation can occur through simply viewing a malicious file in the file explorer, without requiring the file to be launched or the theme applied. This issue was discovered during the development of a patch for a related spoofing issue. The vulnerability allows attackers to affect the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-05379

CVE-2024-38030

Affected Products

Windows

References · 32

• https://bdu.fstec.ru/vul/2024-05379 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38030 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38030 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38030 · Vendor Advisory
• https://twitter.com/ET_Labs/status/1889432437903769613 · Twitter Post
• https://t.me/true_secator/6373 · Telegram Post
• https://twitter.com/transilienceai/status/1856204898892689799 · Twitter Post
• https://twitter.com/transilienceai/status/1858737212495397321 · Twitter Post
• https://twitter.com/transilienceai/status/1854935951610724604 · Twitter Post
• https://twitter.com/transilienceai/status/1858561363393859613 · Twitter Post
• https://twitter.com/transilienceai/status/1858195653278707895 · Twitter Post
• https://t.me/cvenotify/85894 · Telegram Post
• https://vicarius.io/vsociety/posts/cve-2024-38030-mitigation-script-windows-themes-spoofing-vulnerability · Note