{"id":"CVE-2024-29988","kind":"vulnerability","aliases":["CVE-2024-29988"],"related":[],"title":"SmartScreen Prompt Security Feature Bypass Vulnerability","description":"Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft SmartScreen Prompt has a security feature bypass that lets an attacker get past the Mark of the Web warning on downloaded files. It is chained with CVE-2023-38831 and CVE-2024-21412 to run a malicious file.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2024-04-30T00:00:00+00:00","products":[{"name":"Microsoft SmartScreen Prompt","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.5696"],"affected":"< 10.0.17763.5696","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.4291"],"affected":"< 10.0.19044.4291","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.4291"],"affected":"< 10.0.19045.4291","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.2899"],"affected":"< 10.0.22000.2899","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.3447"],"affected":"< 10.0.22621.3447","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.3447"],"affected":"< 10.0.22631.3447","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.5696"],"affected":"< 10.0.17763.5696","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2402"],"affected":"< 10.0.20348.2402","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.830"],"affected":"< 10.0.25398.830","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":"Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2024-04-09T17:16:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:46+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:00:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable.","reach":"unknown","impact":"high","summary":"Microsoft SmartScreen Prompt has a security feature bypass that lets an attacker get past the Mark of the Web warning on downloaded files. It is chained with CVE-2023-38831 and CVE-2024-21412 to run a malicious file.","category":"infrastructure","who_cares":["windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker bypasses download warnings and runs a malicious file on the machine.","analyst_note":"Find Microsoft's MSRC advisory for CVE-2024-29988 for affected builds, patch KB numbers and the specific mitigation steps; the CISA KEV entry gives no detail.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000467,"input_tokens":2878,"output_tokens":359,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':84B,124C '-2024':8A,11A,88B,128C '-21412':89B,129C '-29988':9A,12A '-38831':85B,125C '10':18A,22A,26A '11':30A,34A,38A '1809':19A '2019':43A '2022':47A,51A '21h2':23A,31A '22h2':27A,35A '23h2':39A,52A 'action':137C 'allow':105C 'appli':138C 'attack':67B,107C 'bypass':5A,63B,102C,109C 'chain':81B,121C 'cisa':135C 'contain':98C 'cve':7A,10A,83B,87B,123C,127C 'discontinu':144C 'download':77B 'execut':131C 'exploit':53B 'featur':4A,62B,101C,116C 'file':78B,94B,134C 'get':68B 'infrastructur':54B 'instruct':142C 'let':65B 'malici':93B,133C 'mark':71B,111C 'microsoft':13A,16A,20A,24A,28A,32A,36A,40A,44A,48A,56B,95C 'mitig':139C,150C 'motw':115C 'past':69B 'per':140C 'product':148C 'prompt':2A,15A,58B,97C 'requir':136C 'run':91B 'secur':3A,61B,100C 'server':42A,46A,50A 'smartscreen':1A,14A,57B,96C 'unavail':152C 'use':145C 'vendor':141C 'vulner':6A,103C,118C 'warn':75B 'web':74B,114C 'window':55B 'windows':17A,21A,25A,29A,33A,37A,41A,45A,49A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-09T17:16:01+00:00","kev":{"dateAdded":"2024-04-30","dueDate":"2024-05-21","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-29988","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-29988","severity":null,"published_at":"2024-04-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-29988","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29988","severity":null,"published_at":"2024-04-09T17:16:01+00:00","modified_at":"2026-06-17T07:23:30+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}