PT-2026-24282 · Microsoft · Windows

Nicolas Delhaye · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-24288

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Mobile Broadband (affected versions not specified)

Description A heap-based buffer overflow exists in the Windows Mobile Broadband driver. Exploitation of this issue could allow an unauthorized attacker to execute code. A physical attack is required for exploitation. The vulnerability allows an attacker to execute arbitrary code and affect the system. The entry point for exploitation involves the ability to send unsolicited events from a USB device to the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2026-02999

CVE-2026-24288

Affected Products

Windows

References · 9

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-24288 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24288 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24288 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24288 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24288 · Security Note
• https://twitter.com/_Homeostasie_/status/2033564989894561939 · Twitter Post
• https://twitter.com/infoflowcloud/status/2033756818426454507 · Twitter Post
• https://twitter.com/CVEnew/status/2033755400395268435 · Twitter Post