Known Exploited Vulnerability
7.5
HIGH
CVE-2024-38112
Microsoft Windows MSHTML Platform Spoofing Vulnera - [Actively Exploited]
Description

Windows MSHTML Platform Spoofing Vulnerability

INFO

Published Date :

July 9, 2024, 5:15 p.m.

Last Modified :

Jan. 27, 2025, 9:35 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

1.6
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112; https://nvd.nist.gov/vuln/detail/CVE-2024-38112

Public PoC/Exploit Available at Github

CVE-2024-38112 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-38112 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Microsoft windows_server_2008
2 Microsoft windows_server_2012
3 Microsoft windows_server_2016
4 Microsoft windows_server_2019
5 Microsoft windows_10_1607
6 Microsoft windows_10_1809
7 Microsoft windows_10_21h2
8 Microsoft windows_10_22h2
9 Microsoft windows_server_2022
10 Microsoft windows_11_21h2
11 Microsoft windows_11_22h2
12 Microsoft windows_10_1507
13 Microsoft windows
14 Microsoft windows_11_23h2
15 Microsoft windows_server_2022_23h2
16 Microsoft windows_server_23h2
17 Microsoft windows_server_2012_r2
18 Microsoft windows_server_2008_sp2
: Total Affected Vendor : 1 | Products : 18
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-38112.

URL Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112 Patch Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112 Patch Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
BunBunCodes/CPSC253_CybersecurityFinalProjectReports

Report written on CVE-2024-38112

Updated: 1 week, 1 day ago
0 stars 0 fork 0 watcher
Born at : July 25, 2025, 11:14 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
tylzars/awesome-vrre-writeups

A collection of Vulnerability Research and Reverse Engineering writeups.

Updated: 3 months, 3 weeks ago
1 stars 0 fork 0 watcher
Born at : Dec. 21, 2024, 2:55 p.m. This repo has been linked 49 different CVEs too.
Profile Photo
hogehuga/threatWatchDog

None

Shell

Updated: 4 months ago
3 stars 0 fork 0 watcher
Born at : Aug. 16, 2024, 6:28 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
thepcn3rd/goAdventures

None

Go Python Jupyter Notebook Shell PowerShell C# HTML Dockerfile

Updated: 4 days, 16 hours ago
1 stars 0 fork 0 watcher
Born at : June 9, 2023, 5:41 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-38112 vulnerability anywhere in the article.

  • TheCyberThrone
Microsoft Patch Tuesday Year 2024 Analysis

In 2024, Microsoft’s Patch Tuesday updates played a critical role in addressing security vulnerabilities across various platforms. Throughout the year, a total of 1,000+ vulnerabilities were patched, ... Read more

Published Date: Dec 25, 2024 (7 months, 1 week ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49138 CVE-2024-49126 CVE-2024-49117 CVE-2024-49116 CVE-2024-49112 CVE-2024-49040 CVE-2024-49039 CVE-2024-49019 ...+64 more CVE
  • TheCyberThrone
Most Exploited Vulnerabilities in 2024 Top 20 Analysis

In 2024, the cybersecurity landscape saw a significant number of exploited vulnerabilities, highlighting the ongoing challenges organizations face in protecting their systems and data.Some key trends ... Read more

Published Date: Dec 22, 2024 (7 months, 1 week ago)
CVE-2024-49194 CVE-2024-49138 CVE-2024-49112 CVE-2024-42448 CVE-2024-11667 CVE-2024-9474 CVE-2024-0012 CVE-2024-38112 CVE-2024-20399 CVE-2024-37085 ...+12 more CVE
  • Kaspersky
Exploits and vulnerabilities in Q3 2024

Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mit ... Read more

Published Date: Dec 06, 2024 (7 months, 4 weeks ago)
CVE-2024-45519 CVE-2024-47177 CVE-2024-5290 CVE-2024-38112 CVE-2024-6387 CVE-2024-3183 CVE-2023-51385 CVE-2023-4911 CVE-2023-36802 CVE-2023-38831 ...+11 more CVE
  • Cybersecurity News
Operation “Code on Toast”: A Deep Dive into TA-RedAnt’s Exploitation of Zero-Day Flaw (CVE-2024-38178)

JavaScript execution process in the Chakra engine | Image: NCSCNorth Korean-linked hacking group TA-RedAnt has been implicated in a sophisticated large-scale cyber attack dubbed “Operation Code on Toa ... Read more

Published Date: Dec 02, 2024 (8 months ago)
CVE-2024-10220 CVE-2024-50306 CVE-2024-47855 CVE-2024-38178 CVE-2024-41730 CVE-2024-38112
  • The Cyber Express
Microsoft Patches 117 CVEs: Focus on Critical and Zero-Day Threats

Microsoft has released the October 2024 Patch Tuesday, addressing a total of 117 Common Vulnerabilities and Exposures (CVEs). This month’s Microsoft Patch Tuesday update includes three vulnerabilities ... Read more

Published Date: Oct 09, 2024 (9 months, 3 weeks ago)
CVE-2024-43582 CVE-2024-43573 CVE-2024-43572 CVE-2024-43488 CVE-2024-43468 CVE-2024-43461 CVE-2024-38112 CVE-2024-30040 CVE-2024-21893 CVE-2024-21887 ...+3 more CVE
  • The Hacker News
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild

Microsoft has released security updates to fix a total of 118 vulnerabilities across its software portfolio, two of which have come under active exploitation in the wild. Of the 118 flaws, three are r ... Read more

Published Date: Oct 09, 2024 (9 months, 3 weeks ago)
CVE-2024-43583 CVE-2024-43582 CVE-2024-43573 CVE-2024-43572 CVE-2024-43488 CVE-2024-43468 CVE-2024-20659 CVE-2024-43461 CVE-2024-6197 CVE-2024-38112
  • TheCyberThrone
Microsoft Patch Tuesday – October 2024

Microsoft patched 117 CVEs in October 2024 Patch Tuesday release, with three rated critical, 113 rated important and one rated moderate.27 Elevation of Privilege vulnerabilities7 Security Feature Bypa ... Read more

Published Date: Oct 09, 2024 (9 months, 3 weeks ago)
CVE-2024-43616 CVE-2024-43615 CVE-2024-43614 CVE-2024-43612 CVE-2024-43611 CVE-2024-43609 CVE-2024-43608 CVE-2024-43607 CVE-2024-43604 CVE-2024-43603 ...+123 more CVE
  • Dark Reading
5 CVEs in Microsoft's October Update to Patch Immediately

Source: fadfebrian via ShutterstockMicrosoft's October security update addressed a substantial 117 vulnerabilities, including two actively exploited flaws and three publicly disclosed but as yet unexp ... Read more

Published Date: Oct 08, 2024 (9 months, 3 weeks ago)
CVE-2024-43583 CVE-2024-43582 CVE-2024-43573 CVE-2024-43572 CVE-2024-43533 CVE-2024-43488 CVE-2024-43468 CVE-2024-20659 CVE-2024-43461 CVE-2024-6197 ...+1 more CVE
  • Help Net Security
Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)

For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Plat ... Read more

Published Date: Oct 08, 2024 (9 months, 3 weeks ago)
CVE-2024-43583 CVE-2024-43582 CVE-2024-43573 CVE-2024-43572 CVE-2024-43488 CVE-2024-43468 CVE-2024-20659 CVE-2024-43047 CVE-2024-43461 CVE-2024-6197 ...+2 more CVE
  • Help Net Security
Week in review: Critical VMware vCenter Server bugs fixed, Apple releases iOS 18

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Critical VMware vCenter Server bugs fixed (CVE-2024-38812) Broadcom has released fixes for two vulnera ... Read more

Published Date: Sep 22, 2024 (10 months, 1 week ago)
CVE-2024-38813 CVE-2024-38812 CVE-2024-8190 CVE-2024-43461 CVE-2024-45488 CVE-2024-38112
  • TheCyberThrone
CISA KEV Update September 2024 -Part V

The US CISA adds two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitationThe first vulnerability tracked as CVE-2024-43461, Microsoft Windows MSH ... Read more

Published Date: Sep 17, 2024 (10 months, 2 weeks ago)
CVE-2024-38816 CVE-2024-8696 CVE-2024-8695 CVE-2024-29847 CVE-2024-43461 CVE-2024-6670 CVE-2024-36268 CVE-2024-38112 CVE-2023-43770
  • Cybersecurity News
CISA Flags Two Actively Exploited Vulnerabilities: Critical Threats to Windows and WhatsUp Gold

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, adding two actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immedia ... Read more

Published Date: Sep 17, 2024 (10 months, 2 weeks ago)
CVE-2024-8504 CVE-2024-8503 CVE-2024-43461 CVE-2024-6671 CVE-2024-6670 CVE-2024-6386 CVE-2024-7593 CVE-2024-38193 CVE-2024-38112
  • The Register
Microsoft confirms IE bug squashed in Patch Tuesday was exploited zero-day

Analysis Microsoft, in a low-key update to its September Patch Tuesday disclosures, has confirmed a just-fixed Internet Explorer vulnerability was exploited as a zero-day before it could be patched. R ... Read more

Published Date: Sep 17, 2024 (10 months, 2 weeks ago)
CVE-2024-43461 CVE-2024-38112
  • Dark Reading
'Void Banshee' Exploits Second Microsoft Zero-Day

Source: Anucha Cheechang via ShutterstockMicrosoft has recategorized a bug that the company fixed in this month's Patch Tuesday update as a zero-day vulnerability, which the "Void Banshee" advanced pe ... Read more

Published Date: Sep 16, 2024 (10 months, 2 weeks ago)
CVE-2024-43416 CVE-2024-43461 CVE-2024-38112
  • BleepingComputer
CISA warns of Windows flaw used in infostealer malware attacks

​CISA has ordered U.S. federal agencies to secure their systems against a recently patched Windows MSHTML spoofing zero-day bug exploited by the Void Banshee APT hacking group. The vulnerability (CVE- ... Read more

Published Date: Sep 16, 2024 (10 months, 2 weeks ago)
CVE-2024-43461 CVE-2024-38217 CVE-2024-38112
  • Help Net Security
Microsoft confirms second 0-day exploited by Void Banshee APT (CVE-2024-43461)

CVE-2024-43461, a spoofing vulnerability affecting Windows MSHTML – a software component used by various apps for rendering render web pages on Windows – “was exploited as a part of an attack chain re ... Read more

Published Date: Sep 16, 2024 (10 months, 2 weeks ago)
CVE-2024-43491 CVE-2024-43461 CVE-2024-38217 CVE-2024-38112 CVE-2024-38021
  • security.nl
Microsoft bevestigt alsnog actief misbruik van Windows MSHTML-spoofinglek

Een kwetsbaarheid in Windows waarvoor Microsoft vorige week een beveiligingsupdate uitbracht werd voor het uitkomen van de patch actief misbruikt, zo heeft techbedrijf alsnog bevestigd. In eerste inst ... Read more

Published Date: Sep 16, 2024 (10 months, 2 weeks ago)
CVE-2024-43461 CVE-2024-38112
  • Cybersecurity News
New Zero-Day Emerges After Microsoft Patch Tuesday: CVE-2024-43461 Targets Windows MSHTML

IE and a promote window dialog appear when the victim double-clicks on the .url file | Image: Check PointIn an unexpected turn of events, Microsoft has revised its September 2024 Patch Tuesday securit ... Read more

Published Date: Sep 16, 2024 (10 months, 2 weeks ago)
CVE-2024-29847 CVE-2024-43491 CVE-2024-43461 CVE-2024-38226 CVE-2024-38217 CVE-2024-38014 CVE-2024-42024 CVE-2024-42019 CVE-2024-45321 CVE-2024-38112 ...+3 more CVE
  • BleepingComputer
Windows vulnerability abused braille “spaces” in zero-day attacks

A recently fixed "Windows MSHTML spoofing vulnerability" tracked under CVE-2024-43461 is now marked as previously exploited after it was used in attacks by the Void Banshee APT hacking group. When fir ... Read more

Published Date: Sep 15, 2024 (10 months, 2 weeks ago)
CVE-2024-43461 CVE-2024-38217 CVE-2024-38112
  • Trend Micro
Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities

Summary Trend Micro researchers identified remote code execution attacks on WhatsUp Gold exploiting the Active Monitor PowerShell Script since August 30. These attacks possibly leveraged vulnerabiliti ... Read more

Published Date: Sep 12, 2024 (10 months, 3 weeks ago)
CVE-2024-6671 CVE-2024-6670 CVE-2024-38112 CVE-2024-4885
  • Hackread - Latest Cybersecurity, Tech, Crypto & Hacking News
Microsoft September 2024 Patch Tuesday Fixes 79 Flaws, Including 4 Zero-Days

Microsoft September 2024 Patch Tuesday addresses 79 security vulnerabilities, including four actively exploited zero-days. It covers critical flaws in Windows Installer, MoTW, Publisher, and Windows U ... Read more

Published Date: Sep 10, 2024 (10 months, 3 weeks ago)
CVE-2024-43456 CVE-2024-43491 CVE-2024-43469 CVE-2024-43461 CVE-2024-43455 CVE-2024-38226 CVE-2024-38217 CVE-2024-38014 CVE-2024-38112 CVE-2023-4966
  • Dark Reading
Microsoft Discloses 4 Zero-Days in September Update

Source: CHIEW via ShutterstockAttackers are already actively exploiting four of the 79 vulnerabilities for which Microsoft issued a patch this week as part of its monthly security update.Two of the ze ... Read more

Published Date: Sep 10, 2024 (10 months, 3 weeks ago)
CVE-2024-43416 CVE-2024-43491 CVE-2024-43461 CVE-2024-38242 CVE-2024-38241 CVE-2024-38226 CVE-2024-38217 CVE-2024-38018 CVE-2024-38014 CVE-2024-38112
  • Help Net Security
Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes

September 2024 Patch Tuesday is here and Microsoft has delivered 79 fixes, including those for a handful of zero-days (CVE-2024-38217, CVE-2024-38226, CVE-2024-38014, CVE-2024-43461) exploited by atta ... Read more

Published Date: Sep 10, 2024 (10 months, 3 weeks ago)
CVE-2024-43491 CVE-2024-43464 CVE-2024-43461 CVE-2024-38228 CVE-2024-38227 CVE-2024-38226 CVE-2024-38217 CVE-2024-38018 CVE-2024-38014 CVE-2024-6342 ...+2 more CVE
  • Help Net Security
August 2024 Patch Tuesday forecast: Looking for a calm August release

July ended up being more ‘exciting’ than many of us wanted; we’re supposed to be in the height of summer vacation season. First, we had a large set of updates on Patch Tuesday, then we had to work thr ... Read more

Published Date: Aug 09, 2024 (11 months, 3 weeks ago)
CVE-2024-38112 CVE-2024-38080
  • Cybersecurity News
Google Reveals Effingo: The Tech Behind Moving 1.2 Exabytes Daily

Google has unveiled the technical details of its internal data transfer tool called Effingo, which moves an average of 1.2 exabytes of information daily.At the SIGCOMM 2024 conference in Sydney, a rep ... Read more

Published Date: Aug 08, 2024 (11 months, 3 weeks ago)
CVE-2024-39379 CVE-2024-6695 CVE-2024-6806 CVE-2024-6805 CVE-2024-38112 CVE-2024-31461
  • Cybersecurity News
Proposed US Ban on Chinese Tech Impacts Autonomous Vehicles

The United States Department of Commerce plans to propose a ban on the use of Chinese software in autonomous vehicles in the coming weeks, according to Reuters.The proposed legislation will affect car ... Read more

Published Date: Aug 08, 2024 (11 months, 3 weeks ago)
CVE-2024-39379 CVE-2024-6695 CVE-2024-6806 CVE-2024-6805 CVE-2024-38112 CVE-2024-34102
  • tripwire.com
Tripwire Patch Priority Index for July 2024

Tripwire's July 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft.First on the list are patches for Microsoft Office and Outlook that resolve remote code executio ... Read more

Published Date: Aug 06, 2024 (11 months, 4 weeks ago)
CVE-2024-21417 CVE-2024-39684 CVE-2024-38517 CVE-2024-38112 CVE-2024-38105 CVE-2024-38104 CVE-2024-38102 CVE-2024-38101 CVE-2024-38100 CVE-2024-38099 ...+125 more CVE
  • The Cyber Express
Weekly Vulnerability Report: Cyble Urges Fixes in SolarWinds, Cisco, Ivanti & Microsoft

Cyble Research & Intelligence Labs (CRIL) researchers have analyzed more than 100 security vulnerabilities in the last two weeks, with flaws in IT products from SolarWinds, Cisco, Ivanti, Microsoft, E ... Read more

Published Date: Jul 29, 2024 (1 year ago)
CVE-2024-20419 CVE-2024-20401 CVE-2024-28074 CVE-2024-23475 CVE-2024-23472 CVE-2024-23471 CVE-2024-23470 CVE-2024-23469 CVE-2024-23467 CVE-2024-23466 ...+4 more CVE
  • Cyber Security News
Hackers Exploiting MSHTML vulnerability to Deliver Atlantida Malware

Void Banshee, a threat actor, has been exploiting a critical MSHTML vulnerability, CVE-2024-38112, to distribute the Atlantida InfoStealer malware. This sophisticated campaign has targeted unsuspectin ... Read more

Published Date: Jul 29, 2024 (1 year ago)
CVE-2024-38112
  • 0patch.com
Micropatches Released for Windows MSHTML Platform Spoofing (CVE-2024-38112)

July 2024 Windows Updates brought a patch for CVE-2024-38112, a vulnerability in Windows that allows an attacker to create a Windows Internet Shortcut file (extension .url) that will look exactly like ... Read more

Published Date: Jul 23, 2024 (1 year ago)
CVE-2024-38112
  • Kaspersky
Zero-day vulnerability in Internet Explorer | Kaspersky official blog

As part of its latest Patch Tuesday, Microsoft has released patches for 142 vulnerabilities. Among them were four zero-day vulnerabilities. While two of them were already publicly known, the other two ... Read more

Published Date: Jul 16, 2024 (1 year ago)
CVE-2024-38112 CVE-2024-6387
  • Zero Day Initiative
Uncoordinated Vulnerability Disclosure: The Continuing Issues with CVD

On patch Tuesday last week, Microsoft released an update for CVE-2024-38112, which they said was being exploited in the wild. We at the Trend Micro Zero Day Initiative (ZDI) agree with them because th ... Read more

Published Date: Jul 15, 2024 (1 year ago)
CVE-2024-38112
  • Trend Micro
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks

Exploits & Vulnerabilities Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer usin ... Read more

Published Date: Jul 15, 2024 (1 year ago)
CVE-2024-38112 CVE-2023-50164 CVE-2021-40444
  • krebsonsecurity.com
Microsoft Patch Tuesday, July 2024 Edition

Microsoft Corp. today issued software updates to plug at least 139 security holes in various flavors of Windows and other Microsoft products. Redmond says attackers are already exploiting at least two ... Read more

Published Date: Jul 09, 2024 (1 year ago)
CVE-2024-38112 CVE-2024-38080 CVE-2024-38077 CVE-2024-38076 CVE-2024-38074 CVE-2024-38053 CVE-2024-38021 CVE-2023-23397

The following table lists the changes that have been made to the CVE-2024-38112 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Jan. 27, 2025

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20710 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4651 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4651 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3079 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3880 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3880 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2582 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1009 OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20710 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4651 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4651 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3079 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3880 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3880 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2582 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1009
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112
  • Modified Analysis by [email protected]

    Aug. 14, 2024

    Action Type Old Value New Value
    Removed CWE NIST NVD-CWE-noinfo
    Added CWE NIST NVD-CWE-Other
  • CVE Modified by [email protected]

    Jul. 13, 2024

    Action Type Old Value New Value
    Added CWE Microsoft Corporation CWE-451
    Removed CWE Microsoft Corporation CWE-668
  • Initial Analysis by [email protected]

    Jul. 10, 2024

    Action Type Old Value New Value
    Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112 Patch, Vendor Advisory
    Added CWE NIST NVD-CWE-noinfo
    Added CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20710 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4651 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4651 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3079 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3880 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3880 *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7159 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.6054 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2582 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.1009
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Jul. 10, 2024

    Action Type Old Value New Value
    Added Vulnerability Name Microsoft Windows MSHTML Platform Spoofing Vulnerability
    Added Due Date 2024-07-30
    Added Date Added 2024-07-09
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • CVE Received by [email protected]

    Jul. 09, 2024

    Action Type Old Value New Value
    Added Description Windows MSHTML Platform Spoofing Vulnerability
    Added Reference Microsoft Corporation https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112 [No types assigned]
    Added CWE Microsoft Corporation CWE-668
    Added CVSS V3.1 Microsoft Corporation AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-38112 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-38112 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: