CVE-2024-21351: Windows SmartScreen security feature bypass via code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with a high EPSS percentile and a 7.6 CVSS score, but exploitation requires user interaction and the record lacks technical detail on the bypass mechanism.

What it is

CVE-2024-21351 is a security feature bypass in Microsoft Windows SmartScreen, classified under CWE-94 code injection with an additional no-information CWE. A successful bypass undermines SmartScreen's warning and reputation checks, so users can be led into running content that the feature would normally block or flag.

Impact

An attacker can evade SmartScreen protections to deliver and execute malicious content on a target system, with high integrity impact and limited confidentiality and availability impact per the CVSS vector.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) but requires user interaction (UI:R), meaning a victim must open or act on attacker-supplied content. No authentication is needed on the attacker's side.

Exploitation

CVE-2024-21351 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2024-02-13, remediation due 2024-03-05), and EPSS gives a 30-day exploitation probability of about 0.30 (98th percentile). CISA does not record known ransomware campaign use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-21351 on all affected Windows client and server versions.
• If patching cannot be completed by the CISA due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Prioritize internet-facing and user-workstation systems running the listed Windows 10, Windows 11, and Windows Server builds.
• Restrict execution of untrusted files and enforce attachment and download controls to reduce reliance on SmartScreen alone.

Detection

• Monitor for processes spawned from downloaded or email-delivered files that bypass SmartScreen warnings, especially unusual parent-child process chains.
• Review SmartScreen and Defender event logs for blocked or bypassed reputation checks and correlate with recent file downloads.
• Hunt for code injection indicators in processes handling downloaded content, such as unexpected module loads or injected threads.
• Track patch status of the affected Windows builds against the MSRC update to confirm remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.