---
id: "CVE-2024-38217"
kind: "vulnerability"
aliases: ["CVE-2024-38217"]
title: "Windows Mark of the Web Security Feature Bypass Vulnerability"
severity: "medium"
cvss: 5.4
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1507", "fixed": ["10.0.10240.20766"], "affected": "< 10.0.10240.20766", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1607", "fixed": ["10.0.14393.7336"], "affected": "< 10.0.14393.7336", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1809", "fixed": ["10.0.17763.6293"], "affected": "< 10.0.17763.6293", "ecosystem": "vendor"}, {"name": "microsoft windows 10 21h2", "fixed": ["10.0.19044.4894"], "affected": "< 10.0.19044.4894", "ecosystem": "vendor"}, {"name": "microsoft windows 10 22h2", "fixed": ["10.0.19045.4894"], "affected": "< 10.0.19045.4894", "ecosystem": "vendor"}, {"name": "microsoft windows 11 21h2", "fixed": ["10.0.22000.3197"], "affected": "< 10.0.22000.3197", "ecosystem": "vendor"}, {"name": "microsoft windows 11 22h2", "fixed": ["10.0.22621.4169"], "affected": "< 10.0.22621.4169", "ecosystem": "vendor"}, {"name": "microsoft windows 11 23h2", "fixed": ["10.0.22631.4169"], "affected": "< 10.0.22631.4169", "ecosystem": "vendor"}, {"name": "microsoft windows 11 24h2", "fixed": ["10.0.26100.1742"], "affected": "< 10.0.26100.1742", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2016", "fixed": ["10.0.14393.7336"], "affected": "< 10.0.14393.7336", "ecosystem": "vendor"}, {"name": "microsoft windows server 2019", "fixed": ["10.0.17763.6293"], "affected": "< 10.0.17763.6293", "ecosystem": "vendor"}, {"name": "microsoft windows server 2022", "fixed": ["10.0.20348.2700"], "affected": "< 10.0.20348.2700", "ecosystem": "vendor"}, {"name": "microsoft windows server 2022 23h2", "fixed": ["10.0.25398.1128"], "affected": "< 10.0.25398.1128", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "microsoft-office", "windows"]
not_affected_if: ["unknown"]
published_at: "2024-09-10T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38217", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38217", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Windows Mark of the Web Security Feature Bypass Vulnerability

Windows fails to apply the Mark of the Web tag to certain files, so Windows security warnings and Office Protected View may not trigger on them. An attacker who gets a crafted file to a user can bypass those defenses and gain limited loss of integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:microsoft windows 10 1507 affected < 10.0.10240.20766 fixed 10.0.10240.20766
- vendor:microsoft windows 10 1607 affected < 10.0.14393.7336 fixed 10.0.14393.7336
- vendor:microsoft windows 10 1809 affected < 10.0.17763.6293 fixed 10.0.17763.6293
- vendor:microsoft windows 10 21h2 affected < 10.0.19044.4894 fixed 10.0.19044.4894
- vendor:microsoft windows 10 22h2 affected < 10.0.19045.4894 fixed 10.0.19045.4894
- vendor:microsoft windows 11 21h2 affected < 10.0.22000.3197 fixed 10.0.22000.3197
- vendor:microsoft windows 11 22h2 affected < 10.0.22621.4169 fixed 10.0.22621.4169
- vendor:microsoft windows 11 23h2 affected < 10.0.22631.4169 fixed 10.0.22631.4169
- vendor:microsoft windows 11 24h2 affected < 10.0.26100.1742 fixed 10.0.26100.1742
- vendor:microsoft windows server 2008 affected ? fixed ?
- vendor:microsoft windows server 2008 affected = r2 fixed ?
- vendor:microsoft windows server 2012 affected ? fixed ?
- vendor:microsoft windows server 2012 affected = r2 fixed ?
- vendor:microsoft windows server 2016 affected < 10.0.14393.7336 fixed 10.0.14393.7336
- vendor:microsoft windows server 2019 affected < 10.0.17763.6293 fixed 10.0.17763.6293
- vendor:microsoft windows server 2022 affected < 10.0.20348.2700 fixed 10.0.20348.2700
- vendor:microsoft windows server 2022 23h2 affected < 10.0.25398.1128 fixed 10.0.25398.1128

## Fix

Apply Microsoft's July 2024 Windows security update per vendor instructions, or follow the mitigations Microsoft lists for this CVE. Discontinue use of the product if no mitigation is available, per CISA.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38217
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-38217

## From the sources

Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_