VERT Threat Alert: May 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s May 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1106 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2024-30040

Up first this month, we have a security feature bypass in MSHTML. More specifically, we have an Object Linking and Embedding (OLE) mitigation bypass in Microsoft Office. There is an interesting disconnect in the current Microsoft content that will hopefully be updated soon. At the time of writing, Microsoft indicated that a user would need to download the malicious file and manipulate it, but not open it. However, in the FAQ, they also indicate that successful exploitation relies on the user opening the document. Since Microsoft has reported this as being actively exploited, extra caution should be taken to verify the source of Office documents before opening them. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-30051

A vulnerability in the Windows Desktop Window Manager (DWM) is described by this CVE. Kaspersky, credited with reporting the vulnerability, has released an article about the vulnerability and indicating that they’ve seen it used within QakBot. Successful exploitation of this vulnerability would provide the attacker with SYSTEM privileges. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-30046

The final vulnerability in this section this month is a denial of service impacting Visual Studio 2022. While information on this vulnerability is public, Microsoft has stated that it has a high attack complexity and requires an attacker to repeatedly exploit the issue by sending constant or intermittent data across the network to take advantage of the race. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted.

Other Information

At the time of publication, there were no new advisories included with the May Security Guidance.