Description
Windows Kernel Elevation of Privilege Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 – < 10.0.17763.5458, 10.0.0 – < 10.0.17763.5458 | 10.0.17763.5458 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19043.0 – < 10.0.19044.4046 | 10.0.19044.4046 |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 – < 10.0.19045.4046 | 10.0.19045.4046 |
| Microsoft | Windows 11 version 21H2 | 10.0.0 – < 10.0.22000.2777 | 10.0.22000.2777 |
| Microsoft | Windows 11 version 22H2 | 10.0.22621.0 – < 10.0.22621.3155 | 10.0.22621.3155 |
| Microsoft | Windows 11 version 22H3 | 10.0.22631.0 – < 10.0.22631.3155 | 10.0.22631.3155 |
| Microsoft | Windows 11 Version 23H2 | 10.0.22631.0 – < 10.0.22631.3155 | 10.0.22631.3155 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 – < 10.0.17763.5458 | 10.0.17763.5458 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 – < 10.0.17763.5458 | 10.0.17763.5458 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 – < 10.0.20348.2322 | 10.0.20348.2322 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 – < 10.0.25398.709 | 10.0.25398.709 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Microsoft Windows 11 - Kernel Privilege Escalation EDB-52275 · local · Apr 22, 2025
- Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation EDB-51946 · local · Apr 2, 2024
GitHub 8 repositories
-
hakaioffsec/CVE-2024-21338 ★ 333 · Apr 13, 2024
Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
-
Crowdfense/CVE-2024-21338 ★ 81 · Jul 29, 2024
Windows AppLocker Driver (appid.sys) LPE
-
tykawaii98/CVE-2024-21338_PoC ★ 40 · Jun 23, 2024
-
MistyFir/CVE-2024-21338-Exploit ★ 8 · Mar 11, 2026
-
Zombie-Kaiser/CVE-2024-21338-x64-build- ★ 7 · May 18, 2024
Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
-
hackyboiz/kcfg-bypass ★ 2 · Jan 12, 2025
kcfg bypass example - CVE-2024-21338
-
wusijie/CVE-2024-21338-1 ★ 2 · May 5, 2024
PoC for the Untrusted Pointer Dereference in the appid.sys driver
-
UMU618/CVE-2024-21338 ★ 2 · Apr 17, 2024
Fork of https://github.com/hakaioffsec/CVE-2024-21338
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2024-0387 Microsoft Windows und Microsoft Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2024
- MSRC-CVE-2024-21338 Windows Kernel Elevation of Privilege Vulnerability Microsoft Security Response Center · Feb 28, 2024
References
- Windows Kernel Elevation of Privilege Vulnerability vendor-advisory patch