Microsoft has released 117 CVEs for October 2024, covering various aspects of Windows systems. These include Windows Hyper-V, Windows EFI Partition, Windows Kernel, OpenSSH for Windows, Azure Monitor, Windows Netlogon, Windows Kerberos, BranchCache, Azure Stack, Windows Routing and Remote Access Service (RRAS),.NET and Visual Studio, Windows Remote Desktop Licensing Service, Windows Remote Desktop Services, Microsoft Configuration Manager, Service Fabric, Power BI,.NET,.NET Framework, Visual Studio, Visual Studio Code, DeepSpeed, Windows Resilient File System (ReFS), Windows Common Log File System Driver, Windows Kernel, Microsoft Office SharePoint, Microsoft Office Excel, Microsoft Office Visio, BranchCache, Microsoft Graphics Component, Windows Kernel, Windows Standards-Based Storage Management Service, Windows BitLocker, Windows NTFS, Internet Small Computer Systems Interface (iSCSI), Windows Secure Kernel Mode, Microsoft ActiveX, Windows Telephony Server, Microsoft WDAC OLE DB provider for SQL, Windows Kernel, Windows Hyper-V, and Windows Local Security Authority.
October 2024 Security Updates
This release consists of the following 117 Microsoft CVEs:
Tag CVE Base Score FAQs? Workarounds? Mitigations? Role: Windows Hyper-V CVE-2024-20659 7.1 Yes No No Windows Hyper-V CVE-2024-30092 8.0 Yes No No Windows EFI Partition CVE-2024-37976 6.7 Yes No No Windows Kernel CVE-2024-37979 6.7 Yes No No Windows EFI Partition CVE-2024-37982 6.7 Yes No No Windows EFI Partition CVE-2024-37983 6.7 Yes No No OpenSSH for Windows CVE-2024-38029 7.5 Yes No No Azure Monitor CVE-2024-38097 7.1 Yes No No Windows Netlogon CVE-2024-38124 9.0 Yes No Yes Windows Kerberos CVE-2024-38129 7.5 Yes No No BranchCache CVE-2024-38149 7.5 No No No Azure Stack CVE-2024-38179 8.8 No No No Windows Routing and Remote Access Service (RRAS) CVE-2024-38212 8.8 Yes No No .NET and Visual Studio CVE-2024-38229 8.1 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-38261 7.8 Yes No No Windows Remote Desktop Licensing Service CVE-2024-38262 7.5 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-38265 8.8 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43453 8.8 Yes No No Windows Remote Desktop Services CVE-2024-43456 4.8 Yes No No Microsoft Configuration Manager CVE-2024-43468 9.8 Yes Yes No Service Fabric CVE-2024-43480 6.6 Yes No No Power BI CVE-2024-43481 6.5 Yes No No .NET, .NET Framework, Visual Studio CVE-2024-43483 7.5 No No No .NET, .NET Framework, Visual Studio CVE-2024-43484 7.5 No No No .NET and Visual Studio CVE-2024-43485 7.5 No No No Visual Studio Code CVE-2024-43488 8.8 Yes No No DeepSpeed CVE-2024-43497 8.4 Yes No No Windows Resilient File System (ReFS) CVE-2024-43500 5.5 Yes No No Windows Common Log File System Driver CVE-2024-43501 7.8 Yes No No Windows Kernel CVE-2024-43502 7.1 Yes No No Microsoft Office SharePoint CVE-2024-43503 7.8 Yes No No Microsoft Office Excel CVE-2024-43504 7.8 Yes No No Microsoft Office Visio CVE-2024-43505 7.8 Yes No No BranchCache CVE-2024-43506 7.5 No No No Microsoft Graphics Component CVE-2024-43508 5.5 Yes No No Microsoft Graphics Component CVE-2024-43509 7.8 Yes No No Windows Kernel CVE-2024-43511 7.0 Yes No No Windows Standards-Based Storage Management Service CVE-2024-43512 6.5 No No No Windows BitLocker CVE-2024-43513 6.4 Yes No No Windows NTFS CVE-2024-43514 7.8 Yes No No Internet Small Computer Systems Interface (iSCSI) CVE-2024-43515 7.5 No No No Windows Secure Kernel Mode CVE-2024-43516 7.8 Yes No No Microsoft ActiveX CVE-2024-43517 8.8 Yes No No Windows Telephony Server CVE-2024-43518 8.8 Yes No No Microsoft WDAC OLE DB provider for SQL CVE-2024-43519 8.8 Yes No No Windows Kernel CVE-2024-43520 5.0 Yes No No Role: Windows Hyper-V CVE-2024-43521 7.5 No No No Windows Local Security Authority (LSA) CVE-2024-43522 7.0 Yes No No Windows Mobile Broadband CVE-2024-43523 6.8 Yes No No Windows Mobile Broadband CVE-2024-43524 6.8 Yes No No Windows Mobile Broadband CVE-2024-43525 6.8 Yes No No Windows Mobile Broadband CVE-2024-43526 6.8 Yes No No Windows Kernel CVE-2024-43527 7.8 Yes No No Windows Secure Kernel Mode CVE-2024-43528 7.8 Yes No No Windows Print Spooler Components CVE-2024-43529 7.3 Yes No No RPC Endpoint Mapper Service CVE-2024-43532 8.8 Yes No No Remote Desktop Client CVE-2024-43533 8.8 Yes No Yes Microsoft Graphics Component CVE-2024-43534 6.5 Yes No No Windows Kernel-Mode Drivers CVE-2024-43535 7.0 Yes No No Windows Mobile Broadband CVE-2024-43536 6.8 Yes No No Windows Mobile Broadband CVE-2024-43537 6.5 Yes No No Windows Mobile Broadband CVE-2024-43538 6.5 Yes No No Windows Mobile Broadband CVE-2024-43540 6.5 Yes No No Microsoft Simple Certificate Enrollment Protocol CVE-2024-43541 7.5 No No No Windows Mobile Broadband CVE-2024-43542 6.5 Yes No No Windows Mobile Broadband CVE-2024-43543 6.8 Yes No No Microsoft Simple Certificate Enrollment Protocol CVE-2024-43544 7.5 No No No Windows Online Certificate Status Protocol (OCSP) CVE-2024-43545 7.5 No No No Windows Cryptographic Services CVE-2024-43546 5.6 Yes No No Windows Kerberos CVE-2024-43547 6.5 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43549 8.8 Yes No No Windows Secure Channel CVE-2024-43550 7.4 Yes No No Windows Storage CVE-2024-43551 7.8 Yes No No Windows Shell CVE-2024-43552 7.3 Yes No No Windows NT OS Kernel CVE-2024-43553 7.4 Yes No No Windows Kernel-Mode Drivers CVE-2024-43554 5.5 Yes No No Windows Mobile Broadband CVE-2024-43555 6.5 Yes No No Microsoft Graphics Component CVE-2024-43556 7.8 Yes No No Windows Mobile Broadband CVE-2024-43557 6.5 Yes No No Windows Mobile Broadband CVE-2024-43558 6.5 Yes No No Windows Mobile Broadband CVE-2024-43559 6.5 Yes No No Windows Storage Port Driver CVE-2024-43560 7.8 Yes No No Windows Mobile Broadband CVE-2024-43561 6.5 Yes No No Windows Network Address Translation (NAT) CVE-2024-43562 7.5 No No No Windows Ancillary Function Driver for WinSock CVE-2024-43563 7.8 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43564 8.8 Yes No No Windows Network Address Translation (NAT) CVE-2024-43565 7.5 No No No Role: Windows Hyper-V CVE-2024-43567 7.5 No No No Windows Kernel CVE-2024-43570 6.4 Yes No No Sudo for Windows CVE-2024-43571 5.6 Yes No Yes Microsoft Management Console CVE-2024-43572 7.8 Yes No No Windows MSHTML Platform CVE-2024-43573 6.5 Yes No No Microsoft Windows Speech CVE-2024-43574 8.3 Yes No No Role: Windows Hyper-V CVE-2024-43575 7.5 No No No Microsoft Office CVE-2024-43576 7.8 Yes No Yes OpenSSH for Windows CVE-2024-43581 7.1 Yes No No Windows Remote Desktop CVE-2024-43582 8.1 Yes No No Winlogon CVE-2024-43583 7.8 Yes No No Windows Scripting CVE-2024-43584 7.7 Yes No No Code Integrity Guard CVE-2024-43585 5.5 Yes No Yes Windows Routing and Remote Access Service (RRAS) CVE-2024-43589 8.8 No No No Visual C++ Redistributable Installer CVE-2024-43590 7.8 Yes No No Azure CLI CVE-2024-43591 8.7 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43592 8.8 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43593 8.8 Yes No No Remote Desktop Client CVE-2024-43599 8.8 Yes No No Visual Studio Code CVE-2024-43601 7.1 Yes No No Visual Studio CVE-2024-43603 5.5 No No No Outlook for Android CVE-2024-43604 5.7 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43607 8.8 Yes No No Windows Routing and Remote Access Service (RRAS) CVE-2024-43608 8.8 Yes No No Microsoft Office CVE-2024-43609 6.5 Yes No Yes Windows Routing and Remote Access Service (RRAS) CVE-2024-43611 8.8 Yes No No Power BI CVE-2024-43612 6.9 Yes No No Microsoft Defender for Endpoint CVE-2024-43614 5.5 No No No OpenSSH for Windows CVE-2024-43615 7.1 Yes No No Microsoft Office CVE-2024-43616 7.8 Yes No No We are republishing 4 non-Microsoft CVEs:
CNA Tag CVE FAQs? Workarounds? Mitigations? Hackerone Windows cURL Implementation CVE-2024-6197 Yes No No Chrome Microsoft Edge (Chromium-based) CVE-2024-7025 Yes No No Chrome Microsoft Edge (Chromium-based) CVE-2024-9369 Yes No No Chrome Microsoft Edge (Chromium-based) CVE-2024-9370 Yes No No Security Update Guide Blog Posts
Date Blog Post June 27, 2024 Toward greater transparency: Unveiling Cloud Service CVEs April 9, 2024 Toward greater transparency: Security Update Guide now shares CWEs for CVEs January 6, 2023 Publishing CBL-Mariner CVEs on the Security Update Guide CVRF API January 11, 2022 Coming Soon: New Security Update Guide Notification System February 9, 2021 Continuing to Listen: Good News about the Security Update Guide API January 13, 2021 Security Update Guide Supports CVEs Assigned by Industry Partners December 8, 2020 Security Update Guide: Let’s keep the conversation going November 9, 2020 Vulnerability Descriptions in the New Version of the Security Update Guide Relevant Resources
- The new Hotpatching feature is now generally available. Please see Hotpatching feature for Windows Server Azure Edition virtual machines (VMs) for more information.
- Windows 10 and Windows 11 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10 and Windows 11, in addition to non-security updates. The updates are available via the Microsoft Update Catalog. For information on lifecycle and support dates for Windows 10 and Windows 11 operating systems, please see Windows Lifecycle Facts Sheet.
- Microsoft is improving Windows Release Notes. For more information, please see What's next for Windows release notes.
- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.
- In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.
- Customers running Windows Server 2008 R2, or Windows Server 2008 need to purchase the Extended Security Update to continue receiving security updates. See 4522133 for more information.
Known Issues
You can see these in more detail from the Deployments tab by selecting Known Issues column in the Edit Columns panel.
For more information about Windows Known Issues, please see Windows message center (links to currently-supported versions of Windows are in the left pane).
KB Article Applies To 5044273 Windows 10, version 21H2, Windows 10, version 22H2 5044280 Windows 11, version 21H2 5044281 Windows Server 2022 5044284 Windows 11 version 24H2 5044306 Windows Server 2008 (Security-only update) 5044320 Windows Server 2008 (Monthly Rollup) 5044342 Windows Server 2012 (Monthly Rollup) 5044343 Windows Server 2012 R2 (Monthly Rollup)
