CVE-2024-38014:

Local elevation of privilege in Windows Installer (CVE-2024-38014) affects a broad set of Windows client and server versions. An attacker with local access and low privileges can elevate to high privileges without user interaction, and Microsoft has released security updates to fix the issue. CVSS v3.1 base score is 7.8 (HIGH).

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.8High

Published Date:Sep 10, 2024
CISA KEV Date:Sep 10, 2024
Industries Affected:20

Threat Predictions

EPSS Score:12.8
EPSS Percentile:94%

Exploitability

Score:1.8
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

Windows Installer Elevation of Privilege Vulnerability CVE-2024-38014 is a local privilege escalation affecting many Windows versions. It arises from improper privilege handling in the Windows Installer service and can be exploited by an attacker who already has local access, without user interaction, to elevate privileges on the system. The vulnerability is rated HIGH (CVSS v3.1 base score 7.8) and is addressed by Microsoft security updates across affected client and server editions.

Remediation

Step 1: Apply the Microsoft security updates that address CVE-2024-38014 for all affected Windows editions as soon as possible. Refer to the Microsoft MSRC advisory for the exact KBs to install per OS version.
Step 2: Deploy patches using your usual process (Windows Update, WSUS, SCCM) and reboot systems as required to complete the installation.
Step 3: Verify patch status on each device (check installed updates and confirm the CVE is fixed for the specific OS build) and, where available, run a vulnerability scan to confirm the fixed baseline.
Step 4: Monitor for signs of exploitation (look for unusual MSI/MSIEXEC activity, unexpected installer launches, or privilege escalation events) and review security logs post-patch.
Step 5: If patching is not feasible immediately, apply the vendor-recommended mitigation guidance and ensure robust access controls to limit local privilege escalation risk, though patching remains the primary and recommended remedy.