CVE-2024-38107: Windows Power Dependency Coordinator use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a locally exploitable use-after-free with high confidentiality, integrity and availability impact, and it is confirmed exploited in the wild per CISA KEV.

What it is

CVE-2024-38107 is a use-after-free flaw in the Windows Power Dependency Coordinator that allows a local user to elevate privileges. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft addressed it in its August 2024 update. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it is being used in real attacks and should be treated as urgent.

Impact

A successful attacker gains elevated privileges on the affected host, with high impact to confidentiality, integrity and availability per the CVSS vector. In practice this gives a local user SYSTEM-level control, enabling further compromise of the machine and lateral movement.

Attack surface

The attack is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), so an attacker who already has a foothold or unprivileged account on the host can trigger it. It is not remotely reachable and does not depend on tricking a user into opening a file.

Exploitation

CVE-2024-38107 is listed in CISA KEV with a due date of 2024-09-03, confirming exploitation in the wild; EPSS is 0.01635 (75th percentile), indicating moderate predicted activity. No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft August 2024 security update for CVE-2024-38107 on all affected Windows 10, Windows 11 and Windows Server versions.
• Prioritize patching internet-facing and high-value systems, and meet the CISA KEV remediation deadline of 2024-09-03.
• Restrict and monitor local interactive logon and privilege use to limit the accounts an attacker can leverage for elevation.
• If patching cannot be completed immediately, follow Microsoft's vendor mitigation guidance or discontinue use of the affected product as CISA directs.

Detection

• Monitor for unexpected creation of SYSTEM-level or high-integrity processes spawned from lower-privileged user sessions.
• Alert on suspicious access or manipulation of the Power Dependency Coordinator service and related system components.
• Correlate local privilege-escalation behavior with prior initial-access activity on the same host to catch post-exploitation chains.
• Review Windows security event logs for anomalous token or privilege changes following unprivileged logons.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.