Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack vector is physical (AV:P). What does that mean for this vulnerability?
A physical attack vector means the attacker must have direct physical access to the device in order to exploit the vulnerability. In this case, the issue can only be triggered by physically connecting or manipulating hardware that interacts with the affected system. Remote or network‑based attacks are not possible for this vulnerability.
Security updates
10.0.19044.7058 — https://support.microsoft.com/help/5078885
Vulnerabilities 1
-
Medium 6.8
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.
Revision history
-
#1
Information published.
References
-
CVE-2026-24288 Windows Mobile Broadband Driver Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24288
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss