Skip to content
OpenAdvisories
High MSRC-CVE-2024-30098 1 CVE

Windows Cryptographic Services Security Feature Bypass Vulnerability

Published Jul 9, 2024 · Updated Feb 10, 2026 · Revision 7

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

Are there any further actions I need to take to be protected from this vulnerability?
Yes. The Windows Smart Card infrastructure relies on the Cryptographic Service Provider (CSP) and Key Storage Provider (KSP) to isolate cryptographic operations from the Smart Card implementation. The KSP is part of the Crypto Next Generation (CNG) architecture and is intended to support modern smart cards. In the case of RSA based certificates, the Smart Card Certificate Propagation service automatically overrides the default and uses the CSP instead of the KSP. This limits usage to the cryptography provided by the CSP and does not benefit from the modern cryptography provided by the KSP.
The Windows System event will include text that says:
624: 624, Error: Error, Audit: This system is using CAPI for RSA cryptography operations. Please refer to the following link for more detail: https://go.microsoft.com/fwlink/?linkid=2300823: Audit: This system is using CAPI for RSA cryptography operations. Please refer to the following link for more detail: https://go.microsoft.com/fwlink/?linkid=2300823
Beginning with the July 2024 security updates released on July 9, 2024, this vulnerability will be addressed by removing the RSA override and using the KSP as the default. This change is initially disabled by default to allow customers to test it in their environment and to detect any application compatibility issues that might occur with this change.
Please enable this fix and test applications in your environment that rely on RSA based certificates and smart cards. If you detect applications that rely on the old behavior of defaulting to the CSP, work with your application vendor to update the application so that the KSP can be used by default.
The fix can be enabled by setting the following registry key. Set the registry key to the value 1 to enable the fix for CVE-2024-30098.
Key Value name: Key Value name, DisableCapiOverrideForRSA: DisableCapiOverrideForRSA, Data Type: Data Type, REG_DWORD: REG_DWORD, Data: Data, Set to 1 to enable the fix for CVE-2024-30098 and set to 0 or remove the key to disable the fix.: Set to 1 to enable the fix for CVE-2024-30098 and set to 0 or remove the key to disable the fix.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to create a SHA1 hash collision successfully.

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass digital signatures on a vulnerable system.

Security updates
10.0.26100.6899 — https://support.microsoft.com/help/5066835
10.0.17763.7919 — https://support.microsoft.com/help/5066586
10.0.20348.4294 — https://support.microsoft.com/help/5066782
10.0.22000.3079 — https://support.microsoft.com/help/5040431
10.0.19044.6456 — https://support.microsoft.com/help/5066791
10.0.22621.6060 — https://support.microsoft.com/help/5066793
10.0.25398.1913 — https://support.microsoft.com/help/5066780
10.0.10240.21161 — https://support.microsoft.com/help/5066837
10.0.14393.8519 — https://support.microsoft.com/help/5066836
6.3.9600.22824 — https://support.microsoft.com/help/5066873

Vulnerabilities 1

Revision history

  1. #7

    DisableCapiOverrideForRSA registry key removal date has been updated to 2/9/2027.

  2. #6

    Updated the "Are there any further actions I need to take to be protected from this vulnerability?" FAQ as follows: 1. Added a reminder to customers that The DisableCapiOverrideForRSA registry key will be removed in April 2026. 2. Added an update that states: The October 14, 2025, Windows updates addressing CVE-2024-30098 revealed issues in applications where the code does not correctly identify which provider is managing the key for certificates propagated from a smart card to the certificate store. This misidentification can cause cryptographic operations to fail in certain scenarios. Please see [Guidance for certificate handling for Smart Card propagated certificates](http://support.microsoft.com/kb/5073121) for guidance for application developers on how to detect the correct handler and resolve these issues. These are informational changes only.

  3. #5

    The following updates have been made to CVE-2024-30098: 1. In the Security Updates table, added all supported versions Windows 11 25H2 as they are affected by the vulnerability. 2. To enable the fix by default, Microsoft has released October 2025 security updates for all affected versions of Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2 Edition, Windows 10, and Windows 11. 3. Updated the "Are there any further actions I need to take to be protected from this vulnerability?" FAQ to state that starting with the October 2025 security updates, the fix will be enabled by default (DisableCapiOverrideForRSA set to 1) and the KSP will be used for RSA based certificates in the Smart Card Certificate Propagation service. If you discover applications relying on the old behavior, the DisableCapiOverrideForRSA registry key can be set back to 0 to switch back to auditing mode. The DisableCapiOverrideForRSA registry key will be removed in April 2026. See the FAQ section of this CVE for more information.

  4. #4

    Updated links to security updates. This is an informational change only.

  5. #3

    The following updates have been made to CVE-2024-30098: 1. In the Security Updates table, added all supported versions of the following as they are affected by this vulnerability: Windows 11 24H2 and Windows Server 2025. 2. To comprehensively address this vulnerability, Microsoft has released March 2025 security updates for all affected versions of Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2 Edition, Windows 10, and Windows 11. 3. Updated the "Are there any further actions I need to take to be protected from this vulnerability?" FAQ to state that Starting with the April 2025, the fix will automatically generate an audit event in cases where the Cryptographic Service Provider (CSP) is being used with RSA keys. If you have not already enabled the fix using the DisableCapiOverrideForRSA setting, you should monitor your systems for any error events in the Windows system event log. See the FAQ section of this CVE for more information.

  6. #2

    Added FAQ to explain how this vulnerability is being addressed and further actions customers must take to be protected from it. This is an informational change only.

  7. #1

    Information published.

References