Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2024-30051)

What is affected, what to do

Windows DWM Core Library Elevation of Privilege Vulnerability

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Microsoft Windows 10 Version 1809 to version 10.0.17763.5820, Microsoft Windows Server 2019 to version 10.0.17763.5820, Microsoft Windows Server 2019 (Server Core installation) to version 10.0.17763.5820. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows 10 Version 1809 lt 10.0.17763.0..10.0.17763.5820
• Microsoft Windows Server 2019 lt 10.0.17763.0..10.0.17763.5820
• Microsoft Windows Server 2019 (Server Core installation) lt 10.0.17763.0..10.0.17763.5820
• Microsoft Windows Server 2022 lt 10.0.20348.0..10.0.20348.2461
• Microsoft Windows 11 version 21H2 lt 10.0.0..10.0.22000.2960
• Microsoft Windows 10 Version 21H2 lt 10.0.19043.0..10.0.19044.4412
• Microsoft Windows 11 version 22H2 lt 10.0.22621.0..10.0.22621.3593
• Microsoft Windows 10 Version 22H2 lt 10.0.19045.0..10.0.19045.4412
• Microsoft Windows 11 version 22H3 lt 10.0.22631.0..10.0.22631.3593
• Microsoft Windows 11 Version 23H2 lt 10.0.22631.0..10.0.22631.3593
• Microsoft Windows 10 Version 1507 lt 10.0.10240.0..10.0.10240.20651
• Microsoft Windows 10 Version 1607 lt 10.0.14393.0..10.0.14393.6981
• Microsoft Windows Server 2016 lt 10.0.14393.0..10.0.14393.6981
• Microsoft Windows Server 2016 (Server Core installation) lt 10.0.14393.0..10.0.14393.6981

Fixed in

• Microsoft Windows 10 Version 1809 10.0.17763.5820
• Microsoft Windows Server 2019 10.0.17763.5820
• Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.5820
• Microsoft Windows Server 2022 10.0.20348.2461
• Microsoft Windows 11 version 21H2 10.0.22000.2960
• Microsoft Windows 10 Version 21H2 10.0.19044.4412
• Microsoft Windows 11 version 22H2 10.0.22621.3593
• Microsoft Windows 10 Version 22H2 10.0.19045.4412
• Microsoft Windows 11 version 22H3 10.0.22631.3593
• Microsoft Windows 11 Version 23H2 10.0.22631.3593
• Microsoft Windows 10 Version 1507 10.0.10240.20651
• Microsoft Windows 10 Version 1607 10.0.14393.6981
• Microsoft Windows Server 2016 10.0.14393.6981
• Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.6981

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the May 2024 security update (Patch Tuesday, 2024-05-14) to all Windows clients. The builds in the context are the target baseline: Windows 10 1507 → 10.0.10240.20651, 1607 → 10.0.14393.6981, 1809 → 10.0.17763.5820, 21H2 → 10.0.19044.4412, 22H2 → 10.0.19045.4412, Windows 11 21H2 → 10.0.22000.2960. Look up the per-build KB IDs in the Microsoft Security Update Guide entry for CVE-2024-30051. Any later cumulative update also contains the fix.
   • Check servers that share the codebase. Build 14393 maps to Windows Server 2016 and build 17763 to Windows Server 2019. Confirm affected server SKUs in the vendor advisory. Patch RDS, terminal and VDI hosts first, because many low-privilege users log on to them interactively.
   • Query build inventory (Intune, SCCM/MECM, Defender Vulnerability Management) and track hosts below the target builds as an exception list. Isolate legacy systems that cannot be patched and tag them for review.
   • Triage endpoints that show initial-access alerts first. The bug requires local code execution. Hunt for privilege escalation on hosts with open EDR alerts for phishing attachments, loaders or macro activity (see detection), and contain them on suspicion.
   • On confirmed exploitation: treat the host as fully compromised, since the attacker reached SYSTEM. Rotate the local admin password (LAPS), reset cached domain credentials of users who logged on there, and reimage the host rather than trying to clean it.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: There is no workaround, because the Desktop Window Manager (dwm.exe) cannot be disabled on Windows 10/11. Compensating controls must therefore make the precondition, local code execution, harder to achieve.
   • Application control: Use WDAC or AppLocker policies to block execution from user-writable paths (%APPDATA%, %LOCALAPPDATA%\Temp, Downloads, C:\Users\Public), where exploit binaries and loaders are usually staged.
   • Endpoint hardening: Set Defender ASR rules to block mode, notably "Block Office applications from creating child processes", "Block execution of potentially obfuscated scripts" and "Block executable files unless they meet a prevalence, age, or trusted list criterion". Block internet-sourced macros (Mark-of-the-Web) and enforce EDR tamper protection.
   • IAM / least privilege: Restrict "Allow log on locally" on servers to admin groups and keep RDS user populations minimal. Enable Credential Guard and LSA protection (RunAsPPL) so that SYSTEM access does not translate directly into domain credential theft.
   • Network segmentation: Block client-to-client SMB 445, RPC 135, WinRM 5985/5986 and RDP 3389 via host firewall or private VLANs. This contains lateral movement after escalation, which is the step that turns a single foothold into a ransomware incident.
3. 03

   Runbook step 3

   Detection rules

   • Unexpected children of dwm.exe (Sysmon EID 1 / Security 4688): dwm.exe essentially never spawns children other than WerFault.exe. Sigma shape: ParentImage|endswith: '\dwm.exe' AND NOT Image|endswith: '\WerFault.exe'. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "dwm.exe" and FileName !in~ ("WerFault.exe")
   • Processes running as DWM accounts or SYSTEM with user-session ancestry: shells (cmd.exe, powershell.exe, rundll32.exe) with User = Window Manager\DWM-*, or at System integrity, whose chain traces back to a medium-integrity user process. Flag these as EDR process-ancestry anomalies.
   • dwm.exe crashes: Application log EID 1000/1001 with Faulting application name: dwm.exe and clustered WER reports. Failed exploit attempts often crash DWM or cause a brief screen reset.
   • Foreign modules in dwm.exe (Sysmon EID 7): Image|endswith: '\dwm.exe' AND Signed: 'false', or ImageLoaded from user paths. Add Sysmon EID 10 (ProcessAccess) with TargetImage dwm.exe from unsigned sources.
   • Post-escalation behaviour: new services (System EID 7045), scheduled tasks (Security 4698), LSASS access (Sysmon EID 10 on lsass.exe) and Defender being disabled (Defender EID 5001). Correlate these with freshly executed binaries from %TEMP% or %APPDATA% shortly before.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Windows DWM Core Library Elevation of Privilege Vulnerability

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Windows 10 1507
• Microsoft Microsoft Windows 10 1607
• Microsoft Microsoft Windows 10 1809
• Microsoft Microsoft Windows 10 21H2
• Microsoft Microsoft Windows 10 22h2
• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21h2
• Microsoft Windows 10 Version 22h2
• Microsoft Windows 11 21h2
• Microsoft Microsoft Windows 11 22H2

Weakness classes (CWE)

• CWE-122Heap-based Buffer Overflow

  Variant

  A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

  Entry at MITRE CWE-122

References & sources

• Microsoft Security Update GuideWindows DWM Core Library Elevation of Privilege VulnerabilityVendor advisory, Patch, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-30051government-resource, US government resource
• pwn.watchpwn.watch: Microsoft May 2024: 2 actively exploited zero-dayspwn-watch
• Microsoft Security Update GuideMicrosoft advisory: CVE-2024-30040pwn-watch
• NVD (NIST)NVD: CVE-2024-30040pwn-watch
• NVD (NIST)NVD: CVE-2024-30051pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch