Microsoft's security release of 9 January 2024
Patch Tuesday, January 2024
As of , CISA lists none of the 48 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2024-20666, BitLocker Security Feature Bypass.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 48 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 47 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 5 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-20666BitLocker Security Feature Bypass | Proof of concept | Not on CISA's list | 6.6 Medium | 0.03 |
| 2 | CVE-2024-20697Windows libarchive Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.72 |
| 3 | CVE-2024-21318Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.31 |
| 4 | CVE-2024-21320Windows Themes Spoofing | None | Not on CISA's list | 6.5 Medium | 0.23 |
| 5 | CVE-2024-20674Windows Kerberos Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.17 |
| 6 | CVE-2024-21310Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.12 |
| 7 | CVE-2024-20698Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.09 |
| 8 | CVE-2024-21306Microsoft Bluetooth Driver Spoofing | None | Not on CISA's list | 5.7 Medium | 0.06 |
| 9 | CVE-2024-20653Microsoft Common Log File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 10 | CVE-2024-20656Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 11 | CVE-2024-20683Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 12 | CVE-2024-20700Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.04 |
| 13 | CVE-2024-21312.NET Framework Denial of Service | None | Not on CISA's list | 7.5 High | 0.04 |
| 14 | CVE-2024-0057NET, .NET Framework, and Visual Studio Security Feature Bypass | None | Not on CISA's list | 9.1 Critical | 0.03 |
| 15 | CVE-2024-20676Azure Storage Mover Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.03 |
| 16 | CVE-2024-20677Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 17 | CVE-2024-20661Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 18 | CVE-2024-20672.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 19 | CVE-2024-20687Microsoft AllJoyn API Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 20 | CVE-2024-20696Windows libarchive Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.03 |
| 21 | CVE-2024-21319Microsoft Identity Denial of service | None | Not on CISA's list | 6.8 Medium | 0.03 |
| 22 | CVE-2024-20652Windows HTML Platforms Security Feature Bypass | None | Not on CISA's list | 8.1 High | 0.02 |
| 23 | CVE-2024-20654Microsoft ODBC Driver Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.02 |
| 24 | CVE-2024-21307Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.02 |
| 25 | CVE-2024-20660Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 26 | CVE-2024-20663Windows Message Queuing Client (MSMQC) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 27 | CVE-2024-20664Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 28 | CVE-2024-20680Windows Message Queuing Client (MSMQC) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 29 | CVE-2024-21314Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 30 | CVE-2024-20662Windows Online Certificate Status Protocol (OCSP) Information Disclosure | None | Not on CISA's list | 4.9 Medium | 0.02 |
| 31 | CVE-2024-21305Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.02 |
| 32 | CVE-2024-0056Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass | None | Not on CISA's list | 8.7 High | 0.01 |
| 33 | CVE-2024-20658Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2024-20681Windows Subsystem for Linux Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2024-20682Windows Cryptographic Services Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2024-20686Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2024-21309Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2024-21325Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2024-20657Windows Group Policy Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 40 | CVE-2024-20655Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 41 | CVE-2024-20690Windows Nearby Sharing Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 42 | CVE-2024-21316Windows Server Key Distribution Service Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 43 | CVE-2024-20692Microsoft Local Security Authority Subsystem Service Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 44 | CVE-2024-20694Windows CoreMessaging Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 45 | CVE-2024-20699Windows Hyper-V Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 46 | CVE-2024-21311Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 47 | CVE-2024-21313Windows TCP/IP Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 48 | CVE-2024-20691Windows Themes Information Disclosure | None | Not on CISA's list | 4.7 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 9 January 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.