CVE-2024-38106: Windows Kernel elevation of privilege via race condition

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in the wild per CISA KEV and yields full SYSTEM compromise, though it requires a local foothold and has no public technical detail in this record.

What it is

CVE-2024-38106 is a Windows Kernel elevation of privilege vulnerability affecting a broad set of Windows 10, Windows 11 and Windows Server releases. The record gives only a one-line description and no root-cause detail beyond a CWE-591 (synchronization/race condition) mapping, so the exact faulty component is not stated. It matters because a local attacker who gains a foothold can use it to reach SYSTEM, and CISA added it to KEV on the day of publication.

Impact

A local attacker with low privileges can elevate to kernel/SYSTEM level, gaining full control of the host and the ability to disable security controls or move laterally. Confidentiality, integrity and availability are all rated high.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs existing code execution or an interactive session on the machine but no user interaction and no elevated rights to start. No remote or network vector is described.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-13 with a remediation due date of 2024-09-03, indicating exploitation in the wild; EPSS 30-day probability is about 6.3 percent (93rd percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft August 2024 security update for the affected Windows versions listed in the MSRC advisory; this is the only complete fix.
• Prioritize patching internet-facing and high-value hosts, and treat unpatched endpoints as compromised-capable given KEV status.
• Restrict local interactive logon and code execution where feasible, and enforce least privilege so fewer accounts can host the initial foothold.
• Monitor for and remove unpatched or end-of-support Windows builds that cannot receive the update.

Detection

• Alert on unexpected processes gaining SYSTEM or kernel-level token privileges shortly after a low-privileged process starts.
• Hunt for known local privilege-escalation exploit artifacts and unusual driver or kernel object access patterns on patched-versus-unpatched hosts.
• Correlate EDR telemetry for privilege escalation attempts with the KEV due date window to find hosts still exposed.
• Review Windows update inventory to identify systems missing the August 2024 cumulative update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.