Skip to content
OpenAdvisories
High MSRC-CVE-2024-30077 1 CVE

Windows OLE Remote Code Execution Vulnerability

Published Jun 11, 2024 · Updated Sep 10, 2024 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). This could result in the database returning malicious data that could cause arbitrary code execution on the client.

Security updates
10.0.17763.5936 — https://support.microsoft.com/help/5039217
10.0.20348.2527 — https://support.microsoft.com/help/5039227
10.0.20348.2522 — https://support.microsoft.com/help/5039330
10.0.22000.3019 — https://support.microsoft.com/help/5039213
10.0.19044.4529 — https://support.microsoft.com/help/5039211
10.0.22621.3737 — https://support.microsoft.com/help/5039212
10.0.25398.950 — https://support.microsoft.com/help/5039236
10.0.10240.20680 — https://support.microsoft.com/help/5039225
10.0.14393.7070 — https://support.microsoft.com/help/5039214
6.0.6003.22720 — https://support.microsoft.com/help/5039245
6.0.6003.22720 — https://support.microsoft.com/help/5039266
6.1.7601.27170 — https://support.microsoft.com/help/5039289
6.1.7601.27170 — https://support.microsoft.com/help/5039274
6.2.9200.24919 — https://support.microsoft.com/help/5039260
6.3.9600.22023 — https://support.microsoft.com/help/5039294
10.0.26100.1742 — https://support.microsoft.com/help/5043080

Vulnerabilities 1

Revision history

  1. #2

    In the Security Updates table added Windows 11 Version 24H2 for x64-based Systems and Windows 11 Version 24H2 for ARM64-based systems as these versions are affected by this vulnerability. Microsoft recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  2. #1

    Information published.

References