CVE-2024-30051: Windows DWM Core Library heap overflow elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable privilege escalation with confirmed active exploitation and ransomware association, though it requires an existing low-privileged foothold.

What it is

The Windows Desktop Window Manager (DWM) Core Library contains a heap-based buffer overflow and out-of-bounds write (CWE-122/CWE-787) that allows a local user to elevate privileges. Microsoft rates it 7.8 HIGH, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-05-14, so it is being used in real attacks.

Impact

A local attacker who triggers the overflow can execute code with higher privileges, up to SYSTEM, on the affected Windows host. CISA flags known ransomware campaign use, so successful exploitation can feed into broader ransomware operations.

Attack surface

The CVSS vector AV:L/AC:L/PR:L/UI:N means the flaw is reached locally: the attacker needs low-privileged code execution on the machine and no user interaction. It is not remotely reachable and no authentication beyond an existing local session is required.

Exploitation

CISA KEV lists it as actively exploited with a 2024-06-04 remediation due date and known ransomware campaign use; EPSS is 0.05641 (92.5th percentile), indicating elevated but not top-tier predicted activity. The only reference tags are Patch/Vendor Advisory and US Government Resource, with no public exploit or PoC tag.

What to do

• Apply the Microsoft May 2024 security update for CVE-2024-30051 to all listed Windows 10, Windows 11, and Windows Server versions.
• Prioritize patching internet-facing and high-value endpoints, and meet the CISA KEV due date of 2024-06-04.
• Restrict local interactive logon and code execution rights to reduce the low-privileged foothold this exploit requires.
• Monitor for and remove unpatched or end-of-support Windows builds that cannot receive the fix.

Detection

• Hunt for unexpected processes spawning from or injecting into dwm.exe, which is not a normal parent for user processes.
• Alert on privilege changes to SYSTEM or high-integrity tokens originating from non-service, non-installer processes.
• Correlate endpoint telemetry for heap corruption or crash events in dwm.exe with subsequent suspicious child processes.
• Track hosts missing the May 2024 Windows cumulative update as a patch-compliance indicator.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.