CVE-2024-21338: Windows Kernel IOCTL access control flaw allows privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with known ransomware use, has a high EPSS score and public exploit references, and grants kernel-level control of the host.

What it is

CVE-2024-21338 is an elevation of privilege vulnerability in the Windows kernel caused by an exposed IOCTL with insufficient access control (CWE-822). A local attacker with low privileges can exploit it to gain kernel-level code execution, which matters because kernel access defeats security boundaries and enables full system compromise.

Impact

An attacker gains high confidentiality, integrity and availability impact, effectively taking full control of the affected host from a low-privileged local position. In observed abuse this has been used to disable security tooling and deploy kernel-level rootkit components.

Attack surface

The attack is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), so any process already running under a limited account can reach the vulnerable IOCTL. No remote or network path is described in the record.

Exploitation

CVE-2024-21338 is listed in CISA KEV with a due date of 2024-03-25 and is flagged for known ransomware campaign use, and EPSS gives a 30-day probability of 0.5981 (99th percentile). Multiple references carry Exploit tags, including a technical description of Lazarus abuse as an admin-to-kernel zero-day.

What to do

• Apply the Microsoft patch from the MSRC update guide for CVE-2024-21338 on all listed Windows 10, Windows 11 and Windows Server builds.
• Prioritize internet-facing and high-value endpoints, and treat the CISA KEV due date of 2024-03-25 as the remediation deadline.
• Restrict local administrative and interactive logon rights to reduce the pool of accounts that can reach the vulnerable IOCTL.
• Monitor for and block known vulnerable driver abuse and BYOVD techniques used alongside this flaw.
• If patching is not possible, follow vendor mitigations or discontinue use of the affected product as CISA advises.

Detection

• Alert on unexpected kernel driver loads and unsigned or suspicious drivers on patched and unpatched hosts.
• Hunt for processes making unusual IOCTL calls to kernel drivers, especially from low-privileged contexts.
• Monitor for tampering with or disabling of endpoint security services, which is consistent with post-exploitation use.
• Correlate local privilege escalation attempts with subsequent rootkit or persistence activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.