vulnwire
7.0high

CVE-2024-38136

Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability

Published 2 y ago · modified 4 mo ago · JSON

CVSS
7.0
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 37%
Public exploits
0
none known

Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

0.43% probability of exploitation in the next 30 days, higher than 37% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA3.17.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Microsoft Windows 10 Version 1809
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows Server 2022
  • Microsoft Windows 11 version 21H2
  • Microsoft Windows 10 Version 21H2
  • Microsoft Windows 11 version 22H2
  • Microsoft Windows 10 Version 22H2
  • Microsoft Windows 11 version 22H3
  • Microsoft Windows 11 Version 23H2
  • Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
  • Microsoft Windows 11 Version 24H2

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.