{"id":"CVE-2024-21338","kind":"vulnerability","aliases":["CVE-2024-21338"],"related":[],"title":"Windows Kernel Elevation of Privilege Vulnerability","description":"Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"A flaw in the Windows kernel driver appid.sys exposes an IOCTL handler without proper access control. A local user with any account can use it to escalate to kernel-level (SYSTEM) privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-03-04T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.5458"],"affected":"< 10.0.17763.5458","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.4046"],"affected":"< 10.0.19044.4046","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.4046"],"affected":"< 10.0.19045.4046","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.2777"],"affected":"< 10.0.22000.2777","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.3155"],"affected":"< 10.0.22621.3155","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.3155"],"affected":"< 10.0.22631.3155","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.5458"],"affected":"< 10.0.17763.5458","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2322"],"affected":"< 10.0.20348.2322","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":[],"affected":"<= 10.0.25398.709","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","multi-user","ransomware","self-hosted","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2024-21338 per vendor instructions; CISA says to discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2024-02-13T18:15:49+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:17+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:02:17Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2024-21338 per vendor instructions; CISA says to discontinue use of the product if mitigations are unavailable.","reach":"local","impact":"high","summary":"A flaw in the Windows kernel driver appid.sys exposes an IOCTL handler without proper access control. A local user with any account can use it to escalate to kernel-level (SYSTEM) privileges.","category":"infrastructure","who_cares":["windows","self-hosted","multi-user"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local attacker gains SYSTEM privileges on the Windows machine","analyst_note":"Confirm the patched Windows build numbers and a detection method from the Microsoft advisory for CVE-2024-21338, since the sources do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2857,"output_tokens":353,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':8A,11A '-21338':9A,12A '10':17A,21A,25A '11':29A,33A,37A '1809':18A '2019':42A '2022':46A,50A '21h2':22A,30A '22h2':26A,34A '23h2':38A,51A 'access':76B,104C 'account':83B 'achiev':123C 'action':128C 'allow':118C 'appid.sys':69B,116C 'appli':129C 'attack':121C 'cisa':126C 'contain':98C 'control':77B,105C,113C 'cve':7A,10A 'discontinu':135C 'dispatch':114C 'driver':68B 'elev':3A 'escal':88B,125C 'exploit':52B 'expos':70B,100C 'flaw':63B 'handler':73B 'host':60B 'infrastructur':53B 'input':110C 'instruct':133C 'insuffici':103C 'ioctl':72B,101C,109C 'kernel':2A,67B,91B,97C 'kernel-level':90B 'level':92B 'local':79B,120C 'microsoft':13A,15A,19A,23A,27A,31A,35A,39A,43A,47A,95C 'mitig':130C,141C 'multi':55B 'multi-us':54B 'output':112C 'per':131C 'privileg':5A,94B,124C 'product':139C 'proper':75B 'ransomwar':57B 'requir':127C 'self':59B 'self-host':58B 'server':41A,45A,49A 'system':93B 'unavail':143C 'use':85B,136C 'user':56B,80B 'vendor':132C 'vulner':6A,106C 'window':1A,61B,66B,96C 'windows':14A,16A,20A,24A,28A,32A,36A,40A,44A,48A 'within':107C 'without':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-13T18:15:49+00:00","kev":{"dateAdded":"2024-03-04","dueDate":"2024-03-25","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-21338","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21338","severity":null,"published_at":"2024-03-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-21338","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21338","severity":null,"published_at":"2024-02-13T18:15:49+00:00","modified_at":"2026-08-10T16:18:40+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}