PT-2024-9321 · Microsoft · Windows Common Log File System Driver+1

Published 2024-12-10 · Updated 2026-01-19 · CVE-2024-49138

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver (affected versions not specified)

Description The vulnerability is an elevation-of-privilege issue in the Windows Common Log File System Driver. It allows attackers to gain SYSTEM privileges on Windows devices. The vulnerability has been actively exploited in the wild. Microsoft has released a patch to fix the issue. The vulnerability is a heap-based buffer overflow in the Windows Common Log File System driver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. However, it is recommended to apply the patch released by Microsoft as part of their December 2024 Patch Tuesday update. Ensure your systems are updated now to protect against potential exploitation.

Exploit

LPE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-11011

CVE-2024-49138

Affected Products

Windows

Windows Common Log File System Driver

References · 178

• 🔥 https://github.com/MrAle98/CVE-2024-49138-POC · Exploit
• 🔥 https://exploit-db.com/exploits/52270 · Exploit
• 🔥 https://packetstorm.news/files/id/190585 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49138 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-49138 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/714648 · Security Note
• https://bdu.fstec.ru/vul/2024-11011 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49138 · Security Note
• https://twitter.com/windowsforum/status/1867815768387101032 · Twitter Post
• https://twitter.com/MrAle_98/status/1879459758354403590 · Twitter Post
• https://twitter.com/Action1corp/status/1867129259078123544 · Twitter Post
• https://twitter.com/windowsforum/status/1900262003987374194 · Twitter Post