CVE-2024-38112
Microsoft Windows MSHTML Platform Spoofing Vulnerability
Description
CVE-2024-38112 is a high-severity spoofing vulnerability in the Windows MSHTML platform that affects virtually all supported versions of Windows, including Windows 10, Windows 11, and Windows Server from 2008 through 2022. The vulnerability enables remote code execution through specially crafted internet shortcut files that abuse the retired Internet Explorer engine to bypass modern browser security controls. With a CVSS v3.1 score of 7.5 and an EPSS score of 92.68% at the 99.7th percentile, this is one of the most actively exploited vulnerabilities of 2024. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 30, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20710 |
| microsoft | windows 10 1607 | < 10.0.14393.7159 |
| microsoft | windows 10 1809 | < 10.0.17763.6054 |
| microsoft | windows 10 21h2 | < 10.0.19044.4651 |
| microsoft | windows 10 22h2 | < 10.0.19045.4651 |
| microsoft | windows 11 21h2 | < 10.0.22000.3079 |
| microsoft | windows 11 22h2 | < 10.0.22621.3880 |
| microsoft | windows 11 23h2 | < 10.0.22631.3880 |
| microsoft | windows server 2008 | - |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | < 10.0.14393.7159 |
| microsoft | windows server 2019 | < 10.0.17763.6054 |
| microsoft | windows server 2022 | < 10.0.20348.2582 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1009 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38112(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-38112. The vulnerability exploits the MSHTML (Trident) rendering engine, which powers Internet Explorer and remains present in Windows for backward compatibility. The spoofing aspect involves specially crafted internet shortcut (.url) files that use the MHTML protocol handler to force content rendering through the retired Internet Explorer engine instead of the user's default modern browser. This bypasses the security sandbox and Protected Mode restrictions of modern browsers like Edge and Chrome, allowing an attacker to execute malicious code in a less restricted security context.
Impact Analysis
CVE-2024-38112 is a network-delivered attack (AV:N) with high complexity (AC:H) that requires user interaction (UI:R) to open a malicious internet shortcut file. Despite the high attack complexity, the impact is severe across all three dimensions. Confidentiality (High): a successful exploit gives the attacker access to sensitive data stored on the victim's system, including credentials, documents, and browser data. Integrity (High): the attacker can install malware, modify system files, and establish persistence mechanisms on the compromised machine. Availability (High): the attacker can disrupt system operations, encrypt files for ransom, or render the machine unusable. The extraordinary EPSS score of 92.68% at the 99.7th percentile makes this one of the most exploited vulnerabilities currently tracked, meaning nearly every organization running unpatched Windows is at risk. The attack surface is enormous because all Windows versions from Windows 10 1507 through Windows Server 2022 23H2 are affected, and the MSHTML engine cannot simply be uninstalled. The ransomware status is currently listed as unknown, but the code execution capability makes it a viable vector for ransomware deployment.
Exploit Maturity
CVE-2024-38112 has an extremely mature exploit landscape with confirmed active exploitation in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 30, 2024, confirming real-world attacks. The EPSS score of 92.68% at the 99.7th percentile places this among the top 0.3% of all CVEs by exploitation probability, indicating widespread and persistent targeting by threat actors. Microsoft addressed the vulnerability in the July 2024 security update. The attack technique involves abusing the MHTML protocol handler through specially crafted .url files, which was identified as being used by advanced persistent threat groups to bypass modern browser security. The combination of a network attack vector, broad Windows version coverage, and the inability to remove the underlying MSHTML component makes this an exceptionally dangerous vulnerability even after the patch is available.
Remediation
-
Apply the July 2024 Microsoft security update immediately across all affected Windows systems. The patch modifies how MSHTML handles the MHTML protocol to prevent the spoofing attack. Refer to the Microsoft Security Response Center advisory for specific KB article numbers.
-
Prioritize patching across the full Windows estate as this vulnerability affects an exceptionally wide range of versions: Windows 10 (1507 through 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2008, 2012, 2016, 2019, 2022, and 2022 23H2).
-
Block or quarantine internet shortcut (.url) files at email gateways and web proxies to prevent the primary delivery mechanism from reaching end users. Configure email security solutions to strip or sandbox .url file attachments.
-
Disable the MHTML protocol handler as a temporary mitigation if patching cannot be performed immediately. This can be done through registry modifications or Group Policy to prevent the exploitation path through the retired Internet Explorer engine.
-
Educate users about the risks of opening unsolicited internet shortcut files received via email, messaging platforms, or file-sharing services. Even with patching in place, defense-in-depth through user awareness reduces the risk of similar future attacks.
Technical Details
CVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML platform with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a score of 7.5 (High). The Attack Vector is Network (AV:N), meaning the malicious payload is delivered remotely, typically through email attachments or web downloads containing crafted .url files. Attack Complexity is High (AC:H), reflecting the need for specific conditions such as the victim opening the file and the MHTML protocol handler being functional. Privileges Required is None (PR:N), so no authentication is needed. User Interaction is Required (UI:R), as the victim must open the malicious internet shortcut file. The Scope is Unchanged (S:U), and all three impact metrics are rated High. The attack mechanism exploits the MHTML protocol handler (mhtml:) embedded in .url shortcut files. When a victim opens such a file, Windows invokes the MSHTML (Trident) engine instead of the default browser, effectively rendering content through the retired Internet Explorer with its weaker security model. This bypass allows the attacker to execute scripts and code that would normally be blocked by modern browser sandboxes. The affected versions span the entire supported Windows ecosystem from Windows 10 1507 (build < 10.0.10240.20710) through Windows Server 2022 23H2 (build < 10.0.25398.1009).
Frequently Asked Questions
Is CVE-2024-38112 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2024-38112 to the KEV catalog. Its EPSS score of 92.68% at the 99.7th percentile makes it one of the most exploited vulnerabilities currently tracked, indicating widespread targeting by threat actors.
What systems are affected by CVE-2024-38112?
Virtually all supported Windows versions are affected, including Windows 10 (all editions from 1507 to 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2008, 2012, 2016, 2019, 2022, and 2022 23H2). The vulnerability exists in the MSHTML engine which cannot be removed from Windows.
How does the CVE-2024-38112 attack work?
The attack uses specially crafted internet shortcut (.url) files that abuse the MHTML protocol handler to force content rendering through the retired Internet Explorer engine. This bypasses the security sandbox of modern browsers like Edge, allowing code execution in a less restricted context.
Is CVE-2024-38112 linked to ransomware?
The ransomware association is currently listed as unknown by CISA. However, since the vulnerability enables remote code execution through a common delivery mechanism (internet shortcut files), it is a viable vector for ransomware deployment and should be treated as a critical patching priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.