Main Vulnerability Database Vulnerabilities #VU88344

Use of uninitialized resource in Microsoft Windows and Windows Server - CVE-2024-26220

Published: April 10, 2024

Vulnerability identifier: #VU88344

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-26220

CWE-ID: CWE-908

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Windows Mobile Hotspot. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2024-26220

Install updates from vendor's website.

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26220

Related Security Bulletins