CVE-2024-30051 is a zero-day elevation of privilege vulnerability in the Windows Desktop Window Manager (DWM) Core Library. It was actively exploited in the wild, notably by the QakBot malware, and patched by Microsoft in 2024.
This vulnerability was used to deliver various payloads and was one of the most significant DWM zero-days exploited in recent years.
CVE-2024-30051 was exploited by QakBot malware in targeted attacks. The malware used this vulnerability to escalate privileges on compromised systems, allowing it to disable security features, steal credentials, and deploy ransomware or other malicious payloads.
Microsoft and cybersecurity researchers from Kaspersky uncovered this critical zero-day, which affected even older, out-of-support Windows versions like Windows 10 RTM (version 1507, build 10240).
Microsoft released a patch for Windows 10 RTM specifically for this vulnerability, highlighting its severity and widespread impact.
Microsoft released security updates for this vulnerability as part of a 2024 Patch Tuesday. Users and administrators are strongly advised to apply the update immediately.
For systems that cannot be patched, Microsoft recommends restricting user privileges and monitoring for suspicious activity.