Microsoft's security release of 13 August 2024
Patch Tuesday, August 2024
As of , CISA lists six of the 82 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2024-38178, Scripting Engine Memory Corruption.
On CISA's list of exploited vulnerabilities
- CVE-2024-38178Scripting Engine Memory Corruption. Listed by CISA on 13 August 2024, release day
- CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege. Listed by CISA on 13 August 2024, release day
- CVE-2024-38213Windows Mark of the Web Security Feature Bypass. Listed by CISA on 13 August 2024, release day
- CVE-2024-38189Microsoft Project Remote Code Execution. Listed by CISA on 13 August 2024, release day
- CVE-2024-38106Windows Kernel Elevation of Privilege. Listed by CISA on 13 August 2024, release day
- CVE-2024-38107Windows Power Dependency Coordinator Elevation of Privilege. Listed by CISA on 13 August 2024, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 82 CVEs |
| On CISA's list of exploited vulnerabilities | 6 CVEs |
| CISA's SSVC exploitation: active | 6 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 75 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 7 CVEs |
| EPSS 0.10 or more | 7 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-38178Scripting Engine Memory Corruption | Active | Patch soonListed | 7.5 High | 0.41 |
| 2 | CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.29 |
| 3 | CVE-2024-38213Windows Mark of the Web Security Feature Bypass | Active | Patch soonListed | 6.5 Medium | 0.14 |
| 4 | CVE-2024-38189Microsoft Project Remote Code Execution | Active | Patch soonListed | 8.8 High | 0.08 |
| 5 | CVE-2024-38106Windows Kernel Elevation of Privilege | Active | Patch soonListed | 7.0 High | 0.06 |
| 6 | CVE-2024-38107Windows Power Dependency Coordinator Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 7 | CVE-2024-38063Windows TCP/IP Remote Code Execution | Proof of concept | Not on CISA's list | 9.8 Critical | 0.71 |
| 8 | CVE-2024-38144Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.32 |
| 9 | CVE-2024-38148Windows Secure Channel Denial of Service | None | Not on CISA's list | 7.5 High | 0.32 |
| 10 | CVE-2024-38197Microsoft Teams for iOS Spoofing | None | Not on CISA's list | 6.5 Medium | 0.16 |
| 11 | CVE-2024-38125Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 12 | CVE-2024-38196Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 13 | CVE-2024-38140Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.04 |
| 14 | CVE-2024-38141Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 15 | CVE-2024-38150Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 16 | CVE-2024-38147Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 17 | CVE-2024-38126Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 18 | CVE-2024-38132Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 19 | CVE-2024-38168.NET and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 20 | CVE-2024-38199Windows Line Printer Daemon (LPD) Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 21 | CVE-2024-38109Azure Health Bot Elevation of Privilege | None | Not on CISA's list | 9.1 Critical | 0.02 |
| 22 | CVE-2024-38159Windows Network Virtualization Remote Code Execution | None | Not on CISA's list | 9.1 Critical | 0.02 |
| 23 | CVE-2024-38160Windows Network Virtualization Remote Code Execution | None | Not on CISA's list | 9.1 Critical | 0.02 |
| 24 | CVE-2024-38114Windows IP Routing Management Snapin Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2024-38115Windows IP Routing Management Snapin Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2024-38116Windows IP Routing Management Snapin Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2024-38120Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2024-38121Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 29 | CVE-2024-38128Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 30 | CVE-2024-38130Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 31 | CVE-2024-38154Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 32 | CVE-2024-38180Windows SmartScreen Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.02 |
| 33 | CVE-2024-38127Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 34 | CVE-2024-38138Windows Deployment Services Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.02 |
| 35 | CVE-2024-38145Windows Layer-2 Bridge Network Driver Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 36 | CVE-2024-38146Windows Layer-2 Bridge Network Driver Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 37 | CVE-2024-38214Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 38 | CVE-2024-38143Windows WLAN AutoConfig Service Elevation of Privilege | None | Not on CISA's list | 4.2 Medium | 0.02 |
| 39 | CVE-2024-38108Azure Stack Hub Spoofing | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 40 | CVE-2024-38131Clipboard Virtual Channel Extension Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 41 | CVE-2024-38211Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 8.2 High | 0.01 |
| 42 | CVE-2024-29995Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 43 | CVE-2024-38084Microsoft OfficePlus Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 44 | CVE-2024-38098Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 45 | CVE-2024-38117NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 46 | CVE-2024-38133Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 47 | CVE-2024-38134Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2024-38135Windows Resilient File System (ReFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2024-38142Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 50 | CVE-2024-38152Windows OLE Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2024-38153Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2024-38162Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2024-38163Windows Update Stack Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2024-38169Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2024-38171Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2024-38172Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2024-38177Windows App Installer Spoofing | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2024-38184Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2024-38185Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 60 | CVE-2024-38186Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 61 | CVE-2024-38187Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 62 | CVE-2024-38191Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 63 | CVE-2024-38195Azure CycleCloud Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 64 | CVE-2024-38215Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 65 | CVE-2024-37968Windows DNS Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 66 | CVE-2024-38198Windows Print Spooler Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 67 | CVE-2024-38170Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 68 | CVE-2024-38201Azure Stack Hub Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 69 | CVE-2024-38161Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 70 | CVE-2024-38223Windows Initial Machine Configuration Elevation of Privilege | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 71 | CVE-2024-38173Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 72 | CVE-2024-38165Windows Compressed Folder Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 73 | CVE-2024-38167.NET and Visual Studio Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 74 | CVE-2024-38118Microsoft Local Security Authority (LSA) Server Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 75 | CVE-2024-38122Microsoft Local Security Authority (LSA) Server Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 76 | CVE-2024-38151Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 77 | CVE-2024-38155Security Center Broker Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 78 | CVE-2024-38123Windows Bluetooth Driver Information Disclosure | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 79 | CVE-2024-38136Windows Resource Manager PSM Service Extension Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 80 | CVE-2024-38137Windows Resource Manager PSM Service Extension Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 81 | CVE-2024-38157Azure IoT SDK Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.00 |
| 82 | CVE-2024-38158Azure IoT SDK Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 13 August 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.