PT-2024-6158 · Microsoft · Windows

Gothburz + 1 · Published 2024-09-10 · Updated 2025-12-30 · CVE-2024-43461

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to a Windows MSHTML platform spoofing vulnerability, which allows attackers to execute arbitrary code remotely. This vulnerability has been exploited by the Void Banshee APT group in zero-day attacks, delivering malicious HTML Application (HTA) files camouflaged as PDF documents to spread the Atlantida information stealer. The attackers used a technique involving 26 Braille space characters to hide the extension of the malicious HTA file. The vulnerability affects all supported Windows versions and has been addressed by Microsoft in their July and September 2024 updates.

Recommendations To resolve the issue, apply the July and September 2024 updates to fully protect against exploits targeting this vulnerability. Ensure your operating system is up-to-date to protect against threats related to this vulnerability.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2024-07077

CVE-2024-43461

ZDI-24-1207

Affected Products

Windows

References · 153

• https://bdu.fstec.ru/vul/2024-07077 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43461 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43461 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43461 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43461 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1207 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/711735 · Security Note
• https://twitter.com/BriefBullets/status/1836042039202349289 · Twitter Post
• https://twitter.com/iSecurity/status/1835677794170552572 · Twitter Post
• https://twitter.com/SicurezzaICT/status/1835718188086231324 · Twitter Post
• https://twitter.com/wdormann/status/1836037592753508840 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/1835662057695539514 · Twitter Post
• https://twitter.com/seanchiggins/status/1837145445103018215 · Twitter Post
• https://twitter.com/vipr_lab/status/1836667829615051156 · Twitter Post