CVE-2024-30040
Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability
Description
CVE-2024-30040 is a high-severity security feature bypass vulnerability in the Windows MSHTML platform that affects a broad range of Microsoft Windows operating systems, including Windows 10, Windows 11, and multiple Windows Server editions. The vulnerability allows a remote attacker to bypass MSHTML platform security mitigations by convincing a user to interact with a specially crafted file or link. With a CVSS v3.1 base score of 8.8, successful exploitation can lead to complete system compromise with high impact on confidentiality, integrity, and availability. CISA has added CVE-2024-30040 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 4, 2024, and its EPSS score of 23.49% at the 95.9th percentile indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20651 |
| microsoft | windows 10 1607 | < 10.0.14393.6981 |
| microsoft | windows 10 1809 | < 10.0.17763.5820 |
| microsoft | windows 10 21h2 | < 10.0.19044.4412 |
| microsoft | windows 10 22h2 | < 10.0.19045.4412 |
| microsoft | windows 11 21h2 | < 10.0.22000.2960 |
| microsoft | windows 11 22h2 | < 10.0.22621.3593 |
| microsoft | windows 11 23h2 | < 10.0.22631.3593 |
| microsoft | windows server 2016 | < 10.0.14393.6981 |
| microsoft | windows server 2019 | < 10.0.17763.5820 |
| microsoft | windows server 2022 | < 10.0.20348.2458 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.887 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-30040(US Government Resource)
Weakness Type
Security Feature Bypass in MSHTML Platform
CVE-2024-30040 involves a security feature bypass in the Windows MSHTML platform, which is the rendering engine that underpins Internet Explorer and remains integrated into Windows for backward compatibility and OLE (Object Linking and Embedding) functionality. The vulnerability allows attackers to circumvent security mitigations that normally restrict how MSHTML processes and renders certain content types. This weakness is related to CWE-693 (Protection Mechanism Failure), where an existing security mechanism is defeated or bypassed rather than a completely new attack vector being introduced. The MSHTML platform enforces restrictions on how embedded objects and ActiveX controls interact with the operating system, and this bypass allows malicious content to execute in contexts that should be blocked by those protections. Learn more about CWE-693
Impact Analysis
The impact of CVE-2024-30040 is severe across all three dimensions of the CIA triad. Confidentiality is rated high because bypassing the MSHTML security features allows an attacker to execute code that can access any data available to the current user, including documents, credentials stored in the Windows Credential Manager, and browser session tokens. The MSHTML platform is deeply integrated into Windows and is used by multiple applications beyond Internet Explorer, meaning exploitation can affect document processing, email rendering, and other workflows that rely on HTML rendering.
Integrity faces high impact as the attacker can leverage the security bypass to execute arbitrary code, modify files, install malware, alter system configurations, and establish persistence mechanisms. The bypass of MSHTML platform mitigations means that security controls designed to prevent code execution from untrusted content are rendered ineffective.
Availability is also rated high because arbitrary code execution enables the attacker to terminate processes, corrupt system files, encrypt data for ransomware operations, or cause system instability. The attack is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though user interaction (UI:R) is needed in the form of opening a malicious document or clicking a crafted link. The EPSS score of 23.49% at the 95.9th percentile confirms that this vulnerability is being actively targeted, and CISA lists the ransomware association as "Unknown." The breadth of affected systems, spanning nearly all supported Windows versions, amplifies the overall organizational risk.
Exploit Maturity
CVE-2024-30040 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of June 4, 2024. The EPSS score of 23.49% at the 95.9th percentile places it among the top 5% of vulnerabilities most likely to be exploited, reflecting significant real-world threat activity.
Microsoft acknowledged the vulnerability in its May 2024 Patch Tuesday advisory, confirming that exploitation had been detected before the patch was released, classifying it as a zero-day vulnerability. The MSHTML platform remains a high-value target for attackers because it is present on virtually all Windows installations and is invoked by many applications during document processing and content rendering, even when Internet Explorer is not the default browser. The ransomware association is classified as "Unknown" by CISA, but MSHTML security bypasses have historically been chained with other vulnerabilities to achieve full system compromise in targeted attack campaigns.
Remediation
-
Apply Microsoft security updates immediately by installing the May 2024 cumulative updates for all affected Windows systems. The specific patches are available through the Microsoft Security Response Center advisory and Windows Update. Affected versions include Windows 10 (all supported builds), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2016, 2019, 2022, and 2022 23H2.
-
Prioritize patching based on exposure by identifying systems with internet-facing users or those that process documents from untrusted sources. Email workstations, shared document processing servers, and remote desktop environments should receive the highest priority.
-
Enforce email and document security controls as compensating measures while patches are being deployed. Configure email gateways to block or quarantine suspicious attachments, enable Protected View in Microsoft Office to prevent automatic execution of embedded content, and use Application Guard for Office where available.
-
Enable attack surface reduction (ASR) rules in Microsoft Defender for Endpoint to block suspicious behavior from Office applications and script engines. ASR rules can limit the ability of exploits to leverage MSHTML components for code execution.
-
Monitor for indicators of compromise by reviewing endpoint detection logs for unusual process trees originating from MSHTML-related components, unexpected network connections from document rendering processes, and suspicious file creation in temporary directories associated with content rendering.
Technical Details
CVE-2024-30040 is a security feature bypass vulnerability in the Windows MSHTML platform. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a base score of 8.8 (High).
The MSHTML platform (also known as Trident) is the HTML rendering engine that powered Internet Explorer and remains a core Windows component used for rendering HTML content in various applications, processing OLE objects in Office documents, and handling certain URL protocols. Microsoft has implemented multiple security mitigations in MSHTML to restrict the execution of active content, limit the capabilities of embedded objects, and enforce security zones. CVE-2024-30040 bypasses these mitigations, allowing malicious content to execute in ways that should be blocked.
The attack requires an attacker to convince a user to open a specially crafted document or interact with malicious content that triggers the MSHTML rendering engine. This can occur through email attachments, downloaded files, or embedded content in applications that use MSHTML for rendering. When the malicious content is processed, the security bypass allows it to escape the intended restrictions and execute with the privileges of the current user.
The Attack Vector (AV:N) confirms that the malicious content can be delivered remotely over the network. Attack Complexity (AC:L) is low because no special conditions are needed beyond user interaction. Privileges Required (PR:N) is none, as the attacker needs no account on the target system. User Interaction (UI:R) is required because the user must open or interact with the malicious content. The Scope (S:U) is unchanged, and all CIA metrics are rated high (C:H/I:H/A:H), reflecting the potential for full system compromise through arbitrary code execution. The affected versions span Windows 10 builds 10240 through 19045, Windows 11 builds 22000 through 22631, and all corresponding Windows Server editions.
Frequently Asked Questions
What is CVE-2024-30040?
CVE-2024-30040 is a security feature bypass vulnerability in the Windows MSHTML platform. It allows attackers to circumvent security mitigations designed to restrict how HTML content and embedded objects execute on Windows systems.
Was CVE-2024-30040 exploited as a zero-day?
Yes. Microsoft confirmed that CVE-2024-30040 was actively exploited before the patch was released in May 2024. CISA added it to the Known Exploited Vulnerabilities catalog, further confirming active exploitation in the wild.
Which Windows versions are affected?
Virtually all supported Windows versions are affected, including Windows 10 (versions 1507 through 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2016, 2019, 2022, and 2022 23H2. Apply the May 2024 cumulative updates to remediate.
How can I protect my organization while patching?
Enable Protected View in Microsoft Office, configure email gateways to quarantine suspicious attachments, deploy attack surface reduction rules in Microsoft Defender, and use Application Guard for Office where available. These measures reduce the likelihood of successful exploitation while patches are being applied.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.