1. Home
  2. Vulnerabilities
  3. CVE-2024-38014
Known Exploited Vulnerability
7.8
HIGH CVSS 3.1
CVE-2024-38014
Microsoft Windows Installer Improper Privilege Management Vulnerability - [Actively Exploited]
Description

Windows Installer Elevation of Privilege Vulnerability

INFO

Published Date :

Sept. 10, 2024, 5:15 p.m.

Last Modified :

Jan. 27, 2025, 9:38 p.m.

Remotely Exploit :

No

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014; https://nvd.nist.gov/vuln/detail/CVE-2024-38014

Affected Products

The following products are affected by CVE-2024-38014 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Microsoft windows_server_2008
2 Microsoft windows_server_2012
3 Microsoft windows_server_2016
4 Microsoft windows_server_2019
5 Microsoft windows_10_1607
6 Microsoft windows_10_1809
7 Microsoft windows_10_21h2
8 Microsoft windows_10_22h2
9 Microsoft windows_server_2022
10 Microsoft windows_11_21h2
11 Microsoft windows_11_22h2
12 Microsoft windows_10_1507
13 Microsoft windows
14 Microsoft windows_11_23h2
15 Microsoft windows_server_2022_23h2
16 Microsoft windows_server_23h2
17 Microsoft windows_server_2012_r2
18 Microsoft windows_server_2008_r2
19 Microsoft windows_server_2008_sp2
20 Microsoft windows_11_24h2
: Total Affected Vendor : 1 | Products : 20
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH [email protected]
Solution
A vulnerability exists in Microsoft Windows Installer that could allow for privilege escalation.
  • Apply the appropriate security update based on your operating system version.
  • Reboot the system if required.
Public PoC/Exploit Available at Github

CVE-2024-38014 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-38014.

URL Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014 Patch Vendor Advisory
http://seclists.org/fulldisclosure/2024/Sep/43 Mailing List Third Party Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-38014 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-38014 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Naman2701B/DLL-for-2024-38014

The DLL for CVE-2024-38014

C++ C

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 26, 2025, 8:48 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Naman2701B/CVE-2024-38014

None

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 26, 2025, 8:45 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 2 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.
Profile Photo
sec-consult/msiscan

Scanning tool for identifying local privilege escalation issues in vulnerable MSI installers

Python Shell

Updated: 3 months ago
122 stars 16 fork 16 watcher
Born at : June 24, 2024, 6:02 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-38014 vulnerability anywhere in the article.

  • Cybersecurity News
Microsoft Announces Critical Change to .NET Installer Distribution Domains

Source: MicrosoftMicrosoft’s .NET team, led by Product Manager Richard Lander, has announced a major change in how .NET installers and archives are distributed. This unexpected update, necessitated by ... Read more

Published Date: Dec 27, 2024 (8 months, 3 weeks ago)
  • TheCyberThrone
Microsoft Patch Tuesday Year 2024 Analysis

In 2024, Microsoft’s Patch Tuesday updates played a critical role in addressing security vulnerabilities across various platforms. Throughout the year, a total of 1,000+ vulnerabilities were patched, ... Read more

Published Date: Dec 25, 2024 (8 months, 3 weeks ago)
  • Cybersecurity News
SMOKEDHAM Backdoor: UNC2465’s Stealth Weapon for Extortion and Ransomware Campaigns

A comprehensive analysis by TRAC Labs has shed light on the SMOKEDHAM backdoor, a malicious tool leveraged by the financially motivated threat actor UNC2465. Active since 2019, SMOKEDHAM plays a centr ... Read more

Published Date: Nov 28, 2024 (9 months, 2 weeks ago)
  • Cybersecurity News
Bumblebee Loader Resurfaces with New Infection Chain

In a recent report from Leandro Fróes, Senior Threat Research Engineer at Netskope, a new infection chain linked to the Bumblebee loader has been uncovered. First discovered by Google’s Threat Analysi ... Read more

Published Date: Oct 22, 2024 (10 months, 3 weeks ago)
  • Cybersecurity News
Researcher Releases Open-Source Scanner for CVE-2024-47176 CUPS Vulnerability

Renowned security researcher Marcus Hutchins has unveiled a new open-source tool designed to help administrators and security professionals identify vulnerable instances of the Common Unix Printing Sy ... Read more

Published Date: Oct 08, 2024 (11 months, 1 week ago)
  • 0patch.com
Micropatches for Windows Installer Elevation of Privilege Vulnerability (CVE-2024-38014)

September 2024 Windows Updates brought a patch for CVE-2024-38014, a privilege escalation vulnerability in Windows Installer that could allow a local low-privileged attacker to execute arbitrary code ... Read more

Published Date: Oct 02, 2024 (11 months, 2 weeks ago)
  • tripwire.com
Tripwire Patch Priority Index for September 2024

Tripwire's September 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft.First on the list are patches for Microsoft Excel, Visio, and Publisher that resolve remote ... Read more

Published Date: Oct 02, 2024 (11 months, 2 weeks ago)
  • Cybersecurity News
Critical SolarWinds Flaw Exposes 827 Instances: PoC Exploit Unveiled for CVE-2024-28987

Security researcher Zach Hanley from Horizon3.ai published the technical details and a proof-of-concept (PoC) exploit code for a critical hardcoded credential vulnerability, CVE-2024-28987, in the pop ... Read more

Published Date: Sep 30, 2024 (11 months, 2 weeks ago)
  • Cybersecurity News
New Malware Campaign Mines Crypto in Docker & Kubernetes

Datadog Security Research has uncovered a new and widespread malware campaign targeting Docker and Kubernetes environments, where threat actors exploit vulnerabilities in container orchestration techn ... Read more

Published Date: Sep 26, 2024 (11 months, 3 weeks ago)
  • Cybersecurity News
CVE-2024-38286: Denial-of-Service Vulnerability Discovered in Apache Tomcat

The Apache Software Foundation has issued a security advisory for a newly discovered vulnerability in Apache Tomcat that could allow attackers to execute a denial-of-service (DoS) attack. Identified a ... Read more

Published Date: Sep 24, 2024 (11 months, 3 weeks ago)
  • Cybersecurity News
Critical Security Flaws in Camaleon CMS Put Web Servers at Risk – Users Urged to Upgrade Immediately

In a significant development for website owners and administrators using Camaleon CMS, a critical security update has been released to address several vulnerabilities, some of which are already being ... Read more

Published Date: Sep 21, 2024 (11 months, 3 weeks ago)
  • Cybersecurity News
PoC Exploit Releases for Exploited Vulnerability CVE-2024-8190 in Ivanti Cloud Services Appliance

Authenticated Command Injection | Image: Horizon3.aiA proof-of-concept (PoC) exploit for CVE-2024-8190, an exploited OS command injection vulnerability in Ivanti Cloud Services Appliance, is now publi ... Read more

Published Date: Sep 20, 2024 (11 months, 4 weeks ago)
  • seclists.org
SEC Consult blog :: Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey (CVE-2024-38014) + msiscan tool release

Full Disclosure mailing list archives SEC Consult blog :: Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey (CVE-2024-38014) + msiscan tool release From: SEC Consult Vulnerabilit ... Read more

Published Date: Sep 17, 2024 (1 year ago)
  • Cybersecurity News
New Zero-Day Emerges After Microsoft Patch Tuesday: CVE-2024-43461 Targets Windows MSHTML

IE and a promote window dialog appear when the victim double-clicks on the .url file | Image: Check PointIn an unexpected turn of events, Microsoft has revised its September 2024 Patch Tuesday securit ... Read more

Published Date: Sep 16, 2024 (1 year ago)
  • Help Net Security
Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711) CVE-202 ... Read more

Published Date: Sep 15, 2024 (1 year ago)
  • security.nl
Actief misbruikt lek in Windows Installer sinds januari bij Microsoft bekend

Een kwetsbaarheid in de Windows Installer waar aanvallers actief misbruik van maken bij aanvallen was al sinds januari bij Microsoft bekend. Dat meldt securitybedrijf SEC Consult dat het probleem bij ... Read more

Published Date: Sep 12, 2024 (1 year ago)
  • The Register
About that Windows Installer 'make me admin' security hole. Here's how it's exploited

In this week's Patch Tuesday Microsoft alerted users to, among other vulnerabilities, a flaw in Windows Installer that can be exploited by malware or a rogue user to gain SYSTEM-level privileges to hi ... Read more

Published Date: Sep 12, 2024 (1 year ago)
  • The Cyber Express
Microsoft September 2024 Patch Tuesday: Addressing 79 New Vulnerabilities and Product Updates

The second Tuesday of September has once again proven to be a significant date for cybersecurity with Microsoft’s latest Patch Tuesday update. This month’s release is dominated by a daunting array of ... Read more

Published Date: Sep 11, 2024 (1 year ago)
  • security.nl
Microsoft dicht actief aangevallen kwetsbaarheden in Windows en Publisher

Tijdens de patchdinsdag van september heeft Microsoft vier actief aangevallen kwetsbaarheden verholpen. De beveiligingslekken werden al misbruikt voordat de patches beschikbaar waren. Het gaat om drie ... Read more

Published Date: Sep 11, 2024 (1 year ago)
  • The Hacker News
Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws

Windows Security / Vulnerability Microsoft on Tuesday disclosed that three new security flaws impacting the Windows platform have come under active exploitation as part of its Patch Tuesday update for ... Read more

Published Date: Sep 11, 2024 (1 year ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2024-38014 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Jan. 27, 2025

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4894 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4894 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3197 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.4169 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.4169 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.1742 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.1742 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2700 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1128 OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4894 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4894 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3197 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.4169 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.4169 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.26100.1742 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2700 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1128
    Changed Reference Type http://seclists.org/fulldisclosure/2024/Sep/43 No Types Assigned http://seclists.org/fulldisclosure/2024/Sep/43 Mailing List, Third Party Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2024/Sep/43
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 12, 2024

    Action Type Old Value New Value
    Changed Vulnerability Name Microsoft Windows Installer Privilege Escalation Vulnerability Microsoft Windows Installer Improper Privilege Management Vulnerability
  • Initial Analysis by [email protected]

    Sep. 11, 2024

    Action Type Old Value New Value
    Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014 Patch, Vendor Advisory
    Added CWE NIST NVD-CWE-noinfo
    Added CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.10240.20766 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4894 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4894 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3197 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.4169 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.4169 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.1742 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.1742 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7336 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6293 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2700 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1128
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 11, 2024

    Action Type Old Value New Value
    Added Date Added 2024-09-10
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    Added Vulnerability Name Microsoft Windows Installer Privilege Escalation Vulnerability
    Added Due Date 2024-10-01
  • CVE Received by [email protected]

    Sep. 10, 2024

    Action Type Old Value New Value
    Added Description Windows Installer Elevation of Privilege Vulnerability
    Added Reference Microsoft Corporation https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014 [No types assigned]
    Added CWE Microsoft Corporation CWE-269
    Added CVSS V3.1 Microsoft Corporation AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact