CVE-2024-26229

HIGHNVD 7.89.0▲Weaponized

7.8

Windows CSC Service Elevation of Privilege Vulnerability

CVSS v3: 7.8
EG Score: 9.0(high)
EPSS: 99.4%
KEV: Not listed

Published

April 9, 2024

Last Modified

January 8, 2025

References (2)

secure@microsofthttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229
af854a3a-2127-422b-91ae-364da2661108https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

CWE-122Heap-based Buffer Overflow

All Vendor Advisories

(1)

Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.

Microsoft MSRCCVE-2024-262292024-04-09
Windows CSC Service Elevation of Privilege Vulnerability

Data Freshness Timeline

(refreshed 2× in last 7d / 12× in last 30d)

Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.

2026-05-31 22:30 UTCepss_batch
2026-05-31 22:30 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-26 07:18 UTCepss_batch
2026-05-26 07:18 UTCepss_batch
2026-05-24 04:54 UTCEG score recompute
2026-05-24 04:54 UTCVendor advisory
2026-05-24 04:54 UTCGHSA enrichment

Publicly available exploits

(4 references)

Working exploit code is in the public domain (4 GitHub PoCs). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.

GitHub PoCCracked5pider/eop24-26229
First seen Aug 4, 2024
A firebeam plugin that exploits the CVE-2024-26229 vulnerability to perform elevation of privilege from a unprivileged user
Open source ↗
GitHub PoCteam-MineDEV/CVE-2024-26229
First seen Jun 16, 2024
Windows CSC服务特权提升漏洞。当程序向缓冲区写入的数据超出其处理能力时，就会发生基于堆的缓冲区溢出，从而导致多余的数据溢出到相邻的内存区域。这种溢出会损坏内存，并可能使攻击者能够执行任意代码或未经授权访问系统。本质上，攻击者可以编写触发溢出的恶意代码或输入，从而控制受影响的系统、执行任意命令、安装恶意软件或访问敏感数据。微软已发出警告成功利用此漏洞的攻击者可以获得 SYSTEM 权限，这是 Windows 系统上的最高访问级别。这增加了与 CVE-2024-26229 相关的风险，使其成为恶意行为者的主要目标。
Open source ↗
GitHub PoCapkc/CVE-2024-26229-BOF
First seen Jun 13, 2024
BOF implementations of CVE-2024-26229 for Cobalt Strike and BruteRatel
Open source ↗
GitHub PoCRalfHacker/CVE-2024-26229-exploit
First seen Jun 11, 2024
Windows LPE
Open source ↗

Frequently asked(5)

What is CVE-2024-26229?

CVE-2024-26229 is a high vulnerability published on April 9, 2024. Windows CSC Service Elevation of Privilege Vulnerability

When was CVE-2024-26229 disclosed?

CVE-2024-26229 was first published in the National Vulnerability Database on April 9, 2024, with the most recent update on January 8, 2025. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2024-26229 actively exploited?

CVE-2024-26229 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 99.4% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.

What is the CVSS score of CVE-2024-26229?

CVE-2024-26229 has a CVSS v3 base score of 7.8 (NVD). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 9.0.

How do I remediate CVE-2024-26229?

Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2024-26229, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2024-26229

Explore →

Is Your Infrastructure Affected by CVE-2024-26229?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs

CVE-2024-26229

Published

Last Modified

References (2)

Weakness Classification(1)

All Vendor Advisories

Data Freshness Timeline

Publicly available exploits

Frequently asked(5)

Dependency Blast Radius

Is Your Infrastructure Affected by CVE-2024-26229?

Same vendor

Same CWE

CVE-2024-26229

📅 Published

🔄 Last Modified

🔗 References (2)

Weakness Classification(1)

All Vendor Advisories

Data Freshness Timeline

Publicly available exploits

❓ Frequently asked(5)

Dependency Blast Radius

Is Your Infrastructure Affected by CVE-2024-26229?

🔗 Related CVEs(same vendor + same CWE)

Same vendor

Same CWE

Published

Last Modified

References (2)

Frequently asked(5)

Related CVEs(same vendor + same CWE)