ZeroDay Findings
Sign inSign up

Findings

CVE-2024-21338

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Published Feb 13, 2024 · updated Aug 10, 2026 · microsoft windows 10 1809

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 13, 2024 · Catalog

    Detected

    Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

  2. Mar 4, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Mar 25, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 10, 2026 · Catalog

    Updated

    Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Mar 25, 2024

Affected

  • cpe microsoft/windows 10 1809version unspecified
  • cpe microsoft/windows 10 21h2version unspecified
  • cpe microsoft/windows 10 22h2version unspecified
  • cpe microsoft/windows 11 21h2version unspecified
  • cpe microsoft/windows 11 22h2version unspecified
  • cpe microsoft/windows 11 23h2version unspecified
  • cpe microsoft/windows server 2019version unspecified
  • cpe microsoft/windows server 2022version unspecified
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2024-21338

    Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

    cisa.gov
  • CVE.orgCVE-2024-21338

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-21338

    30-day exploitation probability 59.8%

    first.org
  • Exploit Database51946

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database52275

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2024-21338

    Windows Kernel Elevation of Privilege Vulnerability

    nvd.nist.gov

References