CVE-2024-30051
Microsoft DWM Core Library Privilege Escalation Vulnerability
Description
CVE-2024-30051 is a high-severity elevation of privilege vulnerability in the Windows Desktop Window Manager (DWM) Core Library that allows a local attacker with low-level privileges to escalate to SYSTEM-level access. Affecting Windows 10, Windows 11, and multiple Windows Server editions, this vulnerability has a CVSS v3.1 base score of 7.8 and enables complete compromise of confidentiality, integrity, and availability on the affected system. Critically, CISA has added CVE-2024-30051 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 4, 2024, and has confirmed a known ransomware association, making it one of the most dangerous actively exploited vulnerabilities. Its EPSS score of 47.85% at the 97.6th percentile reflects extremely high real-world exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20651 |
| microsoft | windows 10 1607 | < 10.0.14393.6981 |
| microsoft | windows 10 1809 | < 10.0.17763.5820 |
| microsoft | windows 10 21h2 | < 10.0.19044.4412 |
| microsoft | windows 10 22h2 | < 10.0.19045.4412 |
| microsoft | windows 11 21h2 | < 10.0.22000.2960 |
| microsoft | windows 11 22h2 | < 10.0.22621.3593 |
| microsoft | windows 11 23h2 | < 10.0.22631.3593 |
| microsoft | windows server 2016 | < 10.0.14393.6981 |
| microsoft | windows server 2019 | < 10.0.17763.5820 |
| microsoft | windows server 2022 | < 10.0.20348.2458 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-30051(US Government Resource)
Weakness Type
Elevation of Privilege via DWM Core Library
CVE-2024-30051 is an elevation of privilege vulnerability in the Windows DWM Core Library (dwmcore.dll), which is a critical component of the Windows desktop compositing engine. The vulnerability likely stems from a memory corruption issue such as a heap-based buffer overflow or type confusion within the DWM process, which runs with SYSTEM privileges. This type of weakness is closely related to CWE-122 (Heap-based Buffer Overflow), where improper bounds checking allows an attacker to write beyond allocated memory boundaries, and CWE-269 (Improper Privilege Management), where the elevated privilege context of the DWM service amplifies the impact of the memory corruption. By exploiting this flaw, a low-privileged attacker can execute arbitrary code within the DWM process context and gain SYSTEM-level privileges. Learn more about CWE-269
Impact Analysis
The impact of CVE-2024-30051 is devastating, with high ratings across all CIA triad dimensions and a confirmed ransomware association. Confidentiality is fully compromised because SYSTEM-level privileges grant unrestricted access to all files, registry keys, credentials (including those in LSASS memory), Active Directory secrets on domain controllers, and any encrypted data protected by user or machine DPAPI keys.
Integrity is maximally impacted as SYSTEM privileges allow modification of any file or configuration on the system, installation of rootkits or other persistent malware, manipulation of security logs to cover attack traces, and alteration of Group Policy objects on domain controllers to propagate compromise across the network.
Availability faces high risk because the attacker can terminate any process, corrupt system files to render the machine unbootable, encrypt data for ransomware operations, or deploy destructive payloads. The confirmed ransomware association means that threat actors are actively using this vulnerability as part of ransomware attack chains to escalate privileges before deploying encryptors. The attack requires local access (AV:L) with low complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N). The EPSS score of 47.85% at the 97.6th percentile indicates that nearly half of all observable attack opportunities result in exploitation, placing this among the most actively targeted privilege escalation vulnerabilities in the Windows ecosystem.
Exploit Maturity
CVE-2024-30051 represents one of the most mature and dangerous exploitation scenarios in the current threat landscape. CISA has confirmed not only active exploitation but also a known ransomware association, meaning ransomware operators are incorporating this vulnerability into their attack toolkits for privilege escalation.
Microsoft disclosed the vulnerability as part of the May 2024 Patch Tuesday, acknowledging that exploitation was detected prior to patch release, making it a zero-day vulnerability. Multiple security research organizations reported the vulnerability to Microsoft, suggesting broad awareness and potential use by multiple threat actor groups. The EPSS score of 47.85% at the 97.6th percentile is extraordinarily high, placing it in the top 3% of all vulnerabilities for exploitation probability. DWM elevation of privilege vulnerabilities are particularly valuable to attackers because the DWM service runs on every Windows desktop system and processes window rendering operations that can be triggered by any user-level application, making the attack surface broad and the exploit reliable across different Windows configurations.
Remediation
-
Deploy Microsoft security updates as an emergency priority by installing the May 2024 cumulative updates for all affected Windows systems. The patches are available through Microsoft's advisory and Windows Update. Given the confirmed ransomware association, this vulnerability should be treated with the highest urgency.
-
Prioritize workstations and user-facing systems because the vulnerability requires local access, making endpoints where users execute applications the primary attack surface. Remote desktop servers, shared workstations, and developer machines are at elevated risk.
-
Restrict local code execution by implementing application whitelisting using Windows Defender Application Control (WDAC) or AppLocker. These controls can prevent unauthorized executables from running, reducing the ability of attackers to deploy privilege escalation exploits even if they gain initial access.
-
Enhance endpoint detection coverage by ensuring that EDR solutions are monitoring for suspicious DWM process behavior, including unexpected child processes spawned by dwm.exe, unusual memory allocation patterns, and privilege escalation indicators. Configure alerts for SYSTEM-level process creation from user-context parent processes.
-
Implement backup and ransomware resilience measures given the confirmed ransomware association. Verify that offline or immutable backups are current, test restoration procedures, and ensure that critical data is protected by backup solutions that cannot be accessed or deleted by a compromised SYSTEM-level account.
Technical Details
CVE-2024-30051 is an elevation of privilege vulnerability in the Windows DWM Core Library. The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 7.8 (High).
The Desktop Window Manager (DWM) is a Windows system service responsible for compositing the graphical desktop, managing visual effects such as transparency, animations, and thumbnail previews, and rendering all visible windows. The DWM process (dwm.exe) runs with SYSTEM privileges because it needs to access the display hardware and manage graphics resources across all user sessions. The DWM Core Library (dwmcore.dll) contains the rendering and composition logic.
The vulnerability exists in how the DWM Core Library processes certain rendering operations or handles specific window management requests. A memory corruption flaw, likely a heap overflow or out-of-bounds write, allows a low-privileged attacker to manipulate the DWM process memory and redirect code execution to attacker-controlled payloads. Because dwm.exe runs as SYSTEM, successful exploitation immediately grants SYSTEM-level privileges.
The Attack Vector (AV:L) indicates that the attacker must have local access to the system, which is typically achieved through an initial compromise such as phishing, drive-by download, or exploitation of a separate remote vulnerability. Attack Complexity (AC:L) is low, suggesting the exploit is reliable and does not require winning race conditions or overcoming ASLR/DEP mitigations in a complex manner. Privileges Required (PR:L) means any standard user account can trigger the vulnerability. User Interaction (UI:N) is none, so the exploit can be executed programmatically without any user action. The Scope (S:U) is unchanged, and all CIA impacts are high (C:H/I:H/A:H), reflecting full SYSTEM-level compromise. Affected systems include Windows 10 builds through 19045, Windows 11 builds through 22631, and Windows Server 2016 through 2022.
Frequently Asked Questions
What is CVE-2024-30051?
CVE-2024-30051 is an elevation of privilege vulnerability in the Windows DWM Core Library that allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access. It was exploited as a zero-day before Microsoft released the May 2024 patch.
Is CVE-2024-30051 associated with ransomware?
Yes. CISA has confirmed a known ransomware association for CVE-2024-30051. Ransomware operators are actively using this vulnerability to escalate privileges as part of their attack chains before deploying ransomware payloads.
How is this vulnerability typically exploited?
An attacker who has already gained initial access to a system with a low-privileged account runs a specially crafted exploit that triggers a memory corruption in the DWM Core Library. Because the DWM process runs as SYSTEM, successful exploitation grants the attacker full system control.
Which systems should be patched first?
Prioritize user-facing workstations, remote desktop servers, and any systems where users execute untrusted applications. Since the vulnerability requires local access, endpoints with internet-exposed users represent the highest risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.