Skip to content
OpenAdvisories
High MSRC-CVE-2024-21411 1 CVE

Skype for Consumer Remote Code Execution Vulnerability

Published Mar 12, 2024 · Updated Mar 12, 2024

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by sending the user a malicious link or a malicious image via Instant Message and then convincing the user to click the link or image.

How do I get the update?
Click the Download link.
Under Skype for Desktop select the Get Skype for Windows 10 & 11 arrow to display download options.
Select from the following to download the version you need for your Desktop.
Get Skype for Windows, Get Skype for Mac, Get Skype for Linux SNAP
To verify that you have the latest version of Skype installed, Select Settings > Help & Feedback.
For more information on how to update Skype, see Updating to the latest version of Skype.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could gain high privileges, which include read, write, and delete functionality.

Security updates
8.113 — https://www.skype.com/en/

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References