CVE-2024-35250: Windows Kernel-Mode Driver elevation of privilege via untrusted pointer dereference

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and carries a high EPSS score, but it requires local low-privileged access rather than being remotely exploitable.

What it is

CVE-2024-35250 is an elevation of privilege flaw in a Windows kernel-mode driver, classified as an untrusted pointer dereference (CWE-822). A local attacker with low privileges can exploit it to gain full control of confidentiality, integrity and availability on the host. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft has issued a patch.

Impact

Successful exploitation lets a low-privileged local user escalate to kernel-level code execution, effectively taking full control of the affected system. That access can be used to disable security controls, persist, or move laterally.

Attack surface

The CVSS vector is AV:L/AC:L/PR:L/UI:N, so the flaw is reached locally by an attacker who already holds low privileges on the machine; no user interaction is required. It is not remotely reachable and does not require administrative rights to trigger.

Exploitation

CVE-2024-35250 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2024-12-16, remediation due 2025-01-06), confirming exploitation in the wild. EPSS gives a 30-day probability of 0.25033 (97.8th percentile), indicating high likelihood of attempted exploitation. CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2024-35250 on all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• If patching cannot be completed by the CISA due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Restrict and monitor local interactive logon and low-privileged account use on sensitive hosts to reduce the pool of accounts that can trigger the flaw.
• Enforce least privilege and remove unnecessary local accounts and services that could serve as a low-privileged foothold.

Detection

• Monitor for unexpected kernel-mode driver load or crash events and for processes gaining SYSTEM or kernel-level privileges from low-privileged contexts.
• Alert on local privilege escalation behavior such as token manipulation, suspicious driver interaction, or new services created shortly after low-privileged logon.
• Track patch compliance for the affected Windows builds and flag hosts still unpatched past the CISA due date.
• Correlate local logon events with subsequent high-integrity process creation to surface post-exploitation escalation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.