CVE-2024-38217
Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability
Published Sep 10, 2024 · updated Aug 10, 2026 · microsoft windows 10 1507
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
Timeline
Detection, updates, and resolution for this record.
Sep 10, 2024 · Catalog
Detected
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
Sep 10, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 1, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 10, 2026 · Catalog
Updated
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 1, 2024
Affected
- cpe microsoft/windows 10 1507version unspecified
- cpe microsoft/windows 10 1607version unspecified
- cpe microsoft/windows 10 1809version unspecified
- cpe microsoft/windows 10 21h2version unspecified
- cpe microsoft/windows 10 22h2version unspecified
- vendor Microsoft Windowsversion unspecified
Sources
- CISA KEVCVE-2024-38217
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
cisa.gov - CVE.orgCVE-2024-38217
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-38217
30-day exploitation probability 10.0%
first.org - NIST NVDCVE-2024-38217
Windows Mark of the Web Security Feature Bypass Vulnerability
nvd.nist.gov