CVE-2024-26229
Windows CSC Service Elevation of Privilege Vulnerability
- Published
- Apr 9, 2024
- Updated
- May 3, 2025
- Assigning CNA
- microsoft
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 95.3%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Windows CSC Service Elevation of Privilege Vulnerability
Sources
- CVE-2024-26229-BOFExploit
CVE-2024-26229 Beacon Object File version
- CVE-2024-26229-BOFExploit
BOF implementations of CVE-2024-26229 for Cobalt Strike and BruteRatel
- cve-2024-26229Exploit
Nim touch up of CVE 2024 26229
- CVE-2024-26229Exploit
Windows CSC服务特权提升漏洞。 当程序向缓冲区写入的数据超出其处理能力时，就会发生基于堆的缓冲区溢出，从而导致多余的数据溢出到相邻的内存区域。这种溢出会损坏内存，并可能使攻击者能够执行任意代码或未经授权访问系统。本质上，攻击者可以编写触发溢出的恶意代码或输入，从而控制受影响的系统、执行任意命令、安装恶意软件或访问敏感数据。 微软已发出警告成功利用此漏洞的攻击者可以获得 SYSTEM 权限，这是 Windows 系统上的最高访问级别。这增加了与 CVE-2024-26229 相关的风险，使其成为恶意行为者的主要目标。
- CVE-2024-26229-lpeExploit
CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
Proof-of-concept exploit for CVE-2024-26229, a Windows kernel privilege escalation vulnerability targeting specific system components for local elevation of privileges.
- CVE-2024-26229-exploitExploit
Windows LPE
- CVE-2024-26229Exploit
Windows LPE
- ZeroHVCIPoC
Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.