Buffer overflow in Microsoft Windows and Windows Server - CVE-2024-21338
Published: February 13, 2024 / Updated: April 1, 2026
Vulnerability identifier: #VU86459
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21338
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the appid.sys AppLocker driver. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2024-21338
Install updates from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #12536 - CVE-2024-21338-Exploit (April 1, 2026)
- Exploit #10652 - Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation (October 25, 2024)
- Exploit #10266 - CVE-2024-21338 (August 2, 2024)
- Exploit #10167 - CVE-2024-21338_PoC (July 5, 2024)
- Exploit #9986 - CVE-2024-21338 (June 14, 2024)
- Exploit #9709 - CVE-2024-21338 (April 19, 2024)