Patch Tuesday, August 2024
Microsoft's monthly security release, Tuesday, August 13, 2024. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
6 CVEs · 0 critical · 6 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
6 CVEs · 0 critical · 6 exploited · 1 with public exploit code
- 7.8HighAug 13, 2024Microsoft Windows Memory corruptionCVE-2024-38193Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.Exploited29% likelyExploit codeExploit-DB
- 8.8HighAug 13, 2024Microsoft Project Code / command injectionCVE-2024-38189Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.Exploited8.2% likely
- 7.8HighAug 13, 2024Microsoft Windows Memory corruptionCVE-2024-38107Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.Exploited1.6% likely
- 7.5HighAug 13, 2024Microsoft Windows Memory corruptionCVE-2024-38178Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.Exploited41% likely
- 7.0HighAug 13, 2024Microsoft Windows Privilege escalationCVE-2024-38106Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.Exploited6.3% likely
- 6.5MediumAug 13, 2024Microsoft WindowsCVE-2024-38213Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.Exploited14% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.