MSRC-CVE-2024-21307 — Remote Desktop Client Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required are none (PR:N). What does that mean for this vulnerability?
An unauthorized attacker must wait for a user to initiate a connection.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

Vulnerabilities 1

High 7.5

CVE-2024-21307

Remote Desktop Client Remote Code Execution Vulnerability

Remote Desktop Client Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 9, 2024

Revision history

2024-02-23 #3
Added acknowledgements. This is an informational change only.
2024-01-10 #2
In the Security Updates table, added Remote Desktop client for Windows Desktop as it is also affected by this vulnerability. Customers running Remote Desktop client for Windows Desktop should ensure that they have version 1.2.5105.0 or higher to be protected from this vulnerability.
2024-01-09 #1
Information published.

References

CVE-2024-21307 Remote Desktop Client Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21307
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss