OnlyPatch
Windows DWM Core Library

CVE-2024-30051 — Windows DWM Core Library Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.05687 ⚠️ Exploited in the wild 📢 Publicly disclosed 🔬 Patch diffed 2024-05 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Exploited
MS Exploit Status
Exploitation Detected
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released May 14 2024
Last Updated May 14 2024
Publicly Disclosed Yes
CISA KEV Listed (added 2024-05-14)
Known Exploits None Known
EPSS Score 0.05687 — 0.92317 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Functional
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.2

EPSS Score

0.05687
probability of exploitation in the next 30 days
0.92317 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

23 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5037788 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5037788 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5037763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5037763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5037765 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5037765 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5037765 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5037768 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5037770 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5037770 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5037771 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5037771 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5037771 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5037771 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 5037763 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5037763 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5037765 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5037765 (Security Update) Important Elevation of Privilege Yes

Patches

6 patches
Article Type Restart
5037788 Security Update Yes
5037763 Security Update Yes
5037765 Security Update Yes
5037768 Security Update Yes
5037770 Security Update Yes
5037771 Security Update Yes

Patch Diff

ghidriff · dwmcore.dll (KB5037771)

Patch diff 10.0.22621.3527 -> 10.0.22621.3593 (ITW heap overflow in CCommandBuffer::Initialize)

Pre-patch version 10.0.22621.3527
Post-patch version 10.0.22621.3593
Function Address Change Note
std::_Func_impl_no_alloc<<lambda_dc2c95d2c2f70bb2af203226fe5ee6fa>,void,void_*,unsigned_long,unsigned___int64,unsigned_short_const_*,enum_ProcessAttributionFlags,ProcessAttributionResourceCounters_const_&>::_Delete_this 1800e90e0 -> 1800e9ef0 length, address, called similarity 1.0
CBaseExpression::EnsureExpressionIsUnregistered 18008c560 -> 18009ba80 refcount, address similarity 1.0
CExpressionValueStack::Sqrt 180258ce0 -> 18025cac8 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Matrix4x4FromPerspectiveOffCenter 180256c9c -> 1802598dc code, length, address, calling, called similarity 0.23
Microsoft::WRL::ComPtr<CPathData>::InternalRelease 1800e2430 -> 1800e1860 refcount, address, calling similarity 1.0
CKeyframeAnimation::ApplyPlaybackStateChanges 18005bca0 -> 180056fb0 code, refcount, length, address, called similarity 0.45
CExpressionValueStack::ToDegrees 180258ec8 -> 18025cdb0 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Transform 180258fe0 -> 18025cf68 code, length, address, calling, called similarity 0.3
CExpressionValueStack::QuaternionFromLerp 1802587a0 -> 18025c208 code, length, address, calling, called similarity 0.23
CConditionalExpression::CalculateConditionValue 180220170 -> 180221cdc code, length, address, called similarity 0.24
CD2DBitmapCache::GetCachedTexture 180037bc0 -> 180033ec0 code, length, address, called similarity 0.36
CExpressionValueStack::Swizzle 180087de8 -> 1800c1a68 code, refcount, length, address, calling, called similarity 0.45
CConditionalExpression::~CConditionalExpression 18021fddc -> 18022187c code, length, address, called similarity 0.78
CExpressionValueStack::LengthSquared 180255b80 -> 1802580c8 code, length, address, calling, called similarity 0.27
CExpressionValueStack::QuaternionFromYawPitchRoll 1802589ac -> 18025c544 code, length, address, calling, called similarity 0.27
CExpressionValueStack::Min 180257a30 -> 18025af88 code, length, address, calling, called similarity 0.24
memcpy 18010f568 -> 180114248 refcount, address, calling similarity 0.89
CPrimitiveGroup::EnsureDrawListGenerator 18000f594 -> 180010214 refcount, address similarity 0.96
CExpressionValueStack::Vector3 1800eb344 -> 1800bced8 code, refcount, length, address, called similarity 0.21
CExpressionValueStack::Vector4 1802599a0 -> 18025dea0 code, length, address, calling, called similarity 0.2
CExpressionValueStack::TimeSpanFrom 180258e3c -> 18025ccc4 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Matrix3x2FromRotation 18025654c -> 180258bf0 code, length, address, calling, called similarity 0.24
CExpressionValueStack::GreaterThanEquals 1802557dc -> 180257bec code, length, address, calling, called similarity 0.27
CExpressionValueStack::QuaternionFromAxisAngle 1802586bc -> 18025c088 code, length, address, calling, called similarity 0.23
CExpressionValueStack::Asin 180254c04 -> 180256a50 code, length, address, calling, called similarity 0.38
CExpressionValueStack::ColorLerpRgb 180254f20 -> 180256f54 code, length, address, calling, called similarity 0.23
__GSHandlerCheck 18010f340 -> 180114018 refcount, address similarity 1.0
_guard_xfg_dispatch_icall_nop 18010f5b0 -> 180114290 refcount, address, calling similarity 0.89
CExpressionValueStack::Vector4Transform 180259ba0 -> 18025e298 code, length, address, calling, called similarity 0.28
CExpressionValueStack::Matrix3x2FromSkew 1802566e4 -> 180258e84 code, length, address, calling, called similarity 0.19
atexit 18010b888 -> 18010f818 refcount, address, calling similarity 1.0
CExpressionValueStack::Negate 18006fdf4 -> 1800c12b8 code, refcount, length, address, called similarity 0.4
CNaturalAnimationScalarForceAdapater::Update 18026e270 -> 180272ab0 code, length, address, called similarity 0.2
CPrimitiveGroup::BuildHeatMap 1802407a8 -> 180242498 refcount, address, calling similarity 0.97
CScrollScaleKeyframeAnimation::EnsureChainingConfigUpdated 18025cd90 -> 180261580 code, length, address, called similarity 0.27
CExpressionValueStack::Matrix3x2FromScale 1800f1430 -> 1800f430c code, refcount, length, address, called similarity 0.19
CExpressionValueStack::Scale 180013ac0 -> 180014dbc code, refcount, length, address, calling, called similarity 0.15
CExpressionValueStack::Matrix4x4FromQuaternion 180256e80 -> 180259c6c code, length, address, calling, called similarity 0.34
CExpressionValueStack::Lerp 180255d0c -> 18025828c code, length, address, calling, called similarity 0.09
CExpressionValueStack::Matrix4x4FromPerspectiveFieldOfView 180256b30 -> 180259634 code, length, address, calling, called similarity 0.25
CExpressionValueStack::Matrix4x4 1800e15d4 -> 1800c1664 code, refcount, length, address, called similarity 0.34
CExpressionValueStack::Vector2Dot 180259140 -> 18025d180 code, length, address, calling, called similarity 0.28
CExpressionValueStack::Ceil 180254d38 -> 180256c24 code, length, address, calling, called similarity 0.35
CExpressionValueStack::Matrix4x4FromRotationY 18025708c -> 180259fd4 code, length, address, calling, called similarity 0.24
CExpressionValueStack::Matrix4x4FromYawPitchRoll 180257708 -> 18025aae8 code, length, address, calling, called similarity 0.24
CExpressionValueStack::DistanceSquared 180255328 -> 1802575b0 code, length, address, calling, called similarity 0.22
CKeyframeAnimation::CalculateValueWorker 18005b360 -> 180056670 code, length, address, called similarity 0.97
CExpressionValueStack::Conditional 1800e46a8 -> 1800c1dc8 code, refcount, length, address, called similarity 0.37
CExpressionValueStack::GreaterThan 18001eefc -> 1800201d4 code, refcount, length, address, called similarity 0.29
wil::details::WilApi_GetFeatureEnabledState 1800ca5b4 -> 1800b09c4 refcount, address, calling similarity 1.0
CExpressionValueStack::Vector3Transform 18025972c -> 18025dae4 code, length, address, calling, called similarity 0.27
CExpressionValueStack::Vector2TransformNormal 1802593d0 -> 18025d55c code, length, address, calling, called similarity 0.26
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl 1800ca314 -> 1800b0724 refcount, address, calling, called similarity 0.98
CGdiSpriteBitmap::RegisterWithSurfaceManager 1800ace48 -> 1800a9b88 length, address similarity 1.0
CExpressionValueStack::Square 18001c748 -> 18001d954 code, refcount, length, address, called similarity 0.38
wil::srwlock::lock_exclusive 1800ca5dc -> 1800b09ec refcount, address, calling similarity 1.0
CDataStreamWriter::FlushData 1800a95f8 -> 1800bc594 length, address similarity 1.0
wil::com_ptr_t<CAtlasBitmapResource,wil::err_returncode_policy>::~com_ptr_t<CAtlasBitmapResource,wil::err_returncode_policy> 1800297e4 -> 180034694 refcount, address, calling similarity 1.0
CExpressionValueStack::ColorHsl 180254dc0 -> 180256cfc code, length, address, calling, called similarity 0.21
CExpressionValueStack::Ln 1802563d4 -> 1802589d8 code, length, address, calling, called similarity 0.36
CExpressionValueStack::ToRadians 180258f54 -> 18025ce8c code, length, address, calling, called similarity 0.38
CExpressionValueStack::Max 180257840 -> 18025ad10 code, length, address, calling, called similarity 0.24
CPrimitiveGroup::GenerateDrawList 18000f520 -> 180010140 code, refcount, length, address, called similarity 0.35
wil::details::ReportUsageToService 1800837f0 -> 180051570 refcount, address, calling, called similarity 0.98
CCommandBuffer::Initialize 1800106b8 -> 180011454 code, refcount, length, address, called similarity 0.12
CExpressionValueStack::Clamp 18001e2b4 -> 18001f5ec code, refcount, length, address, called similarity 0.11
CExpressionValueStack::Concatenate 180255088 -> 1802571bc code, length, address, calling, called similarity 0.27
ReleaseInterface<ID2D1Geometry> 18003341c -> 1800927a4 refcount, address, calling similarity 1.0
wil::details_abi::heap_buffer::push_back 1800f6a14 -> 1800fa5c4 refcount, address, calling similarity 1.0
CExpressionValueStack::LessThanEquals 18001ee84 -> 180020018 code, refcount, length, address, called similarity 0.28
CExpressionValueStack::Add 1800132ac -> 180013f58 code, refcount, length, address, called similarity 0.13
CExpressionValueStack::Round 180258ab0 -> 18025c748 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Vector3Dot 180259624 -> 18025d924 code, length, address, calling, called similarity 0.24
memset 18010c4d8 -> 180110468 refcount, address, calling similarity 0.89
CExpressionValueStack::Divide 180072980 -> 1800c0ef0 code, refcount, length, address, called similarity 0.24
CExpressionValueStack::Vector4Dot 180259aa4 -> 18025e0dc code, length, address, calling, called similarity 0.26
CExpressionValueStack::LessThan 1800e2500 -> 1800c1eb0 code, refcount, length, address, called similarity 0.28
wil::details::unique_storage<wil::details::resource_policy<_RTL_SRWLOCK*___ptr64,void_(__cdecl*)(_RTL_SRWLOCK*___ptr64),&void___cdecl_ReleaseSRWLockExclusive(struct__RTL_SRWLOCK*___ptr64),wistd::integral_constant<unsigned___int64,1>,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage<wil::details::resource_policy<_RTL_SRWLOCK*___ptr64,void_(__cdecl*)(_RTL_SRWLOCK*___ptr64),&void___cdecl_ReleaseSRWLockExclusive(struct__RTL_SRWLOCK*___ptr64),wistd::integral_constant<unsigned___int64,1>,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> 1800ca140 -> 1800b060c refcount, address, calling similarity 1.0
CExpressionValueStack::Inverse 180255894 -> 180257d60 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Subtract 1800168d4 -> 180018bd8 code, refcount, length, address, called similarity 0.21
CExpressionValueStack::Vector3Cross 180259524 -> 18025d768 code, length, address, calling, called similarity 0.23
CExpressionValueStack::ColorLerpHsl 1800152a4 -> 180015e44 code, refcount, length, address, calling, called similarity 0.21
CExpressionValueStack::Distance 180255148 -> 18025733c code, length, address, calling, called similarity 0.24
CExpressionValueStack::Matrix4x4FromTranslation 1800e412c -> 1800bdc4c code, refcount, length, address, called similarity 0.18
CExpressionValueStack::NotEquals 180257e8c -> 18025b5c4 code, length, address, calling, called similarity 0.33
DefaultHeap::Free 18007c514 -> 1800898a4 refcount, address, calling similarity 1.0
operator_new[] 180038c50 -> 180034c10 refcount, address, calling similarity 1.0
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::SetEvent EXTERNAL:00000062 refcount, calling similarity 1.0
CExpressionValueStack::Equals 180255500 -> 180257824 code, length, address, calling, called similarity 0.3
CExpressionValueStack::Matrix4x4FromPerspective 1802569cc -> 18025938c code, length, address, calling, called similarity 0.25
CBaseExpression::CalculateValue 180086550 -> 180054250 code, refcount, length, address, called similarity 0.28
CExpressionValueStack::QuaternionFromRotationMatrix 1802588b8 -> 18025c418 code, length, address, calling, called similarity 0.36
CExpressionValueStack::Absolute 180254918 -> 180256608 code, length, address, calling, called similarity 0.27
CExpressionValueStack::Matrix4x4FromRotationZ 1802571cc -> 18025a234 code, length, address, calling, called similarity 0.24
CExpressionValueStack::Length 1802559f0 -> 180257f00 code, length, address, calling, called similarity 0.27
CExpressionValueStack::Matrix4x4FromAxisAngle 1802568c0 -> 1802591ec code, length, address, calling, called similarity 0.24
CConditionalExpression::GetValue 1802205e0 -> 1802221a0 code, length, address, called similarity 0.44
CNaturalAnimation::PeekStackValue 180235b84 -> 180237794 code, length, address, called similarity 0.42
CExpressionValueStack::Vector2Transform 180259214 -> 18025d308 code, length, address, calling, called similarity 0.24
D2D1::Matrix3x2F::SetProduct 180045e34 -> 180080894 refcount, address, calling similarity 1.0
CSharedSectionBase::ResolveAllocation 180088bf0 -> 180098d48 refcount, address, calling similarity 1.0
MilInstrumentationCheckHR_MaybeFailFast 18008807c -> 1800c15e8 refcount, address, calling similarity 1.0
CKeyframeAnimation::ProcessSetBindingBroken 180034af0 -> 1800bd980 code, length, address, called similarity 0.32
CExpressionValueStack::Normalize 180257d08 -> 18025b398 code, length, address, calling, called similarity 0.3
CExpressionValueStack::Log10 180256490 -> 180258ae4 code, length, address, calling, called similarity 0.36
CExpressionValueStack::Pow 18001b7f0 -> 18001cdf0 code, refcount, length, address, called similarity 0.29
CExpressionValueStack::And 180254b48 -> 1802568cc code, length, address, calling, called similarity 0.27
CScrollPositionKeyframeAnimation::EnsureChainingConfigUpdated 18025c880 -> 180261020 code, length, address, called similarity 0.35
CConditionalExpression::AddStackValueToSum 18021ff1c -> 180221a3c code, length, address, called similarity 0.55
CExpressionValueStack::Acos 180254a9c -> 1802567d0 code, length, address, calling, called similarity 0.38
CExpressionValueStack::Atan 180254cb0 -> 180256b4c code, length, address, calling, called similarity 0.35
CExpressionValueStack::Multiply 180072818 -> 1800c0aa8 code, refcount, length, address, called similarity 0.18
CExpressionValue::operator= 180015688 -> 180016350 refcount, address, calling similarity 1.0
CPrimitiveGroup::ProcessAddPrimitives 1800a9dac -> 1800e200c code, refcount, length, address, called similarity 0.64
CExpressionValueStack::Or 1802580b4 -> 18025b888 code, length, address, calling, called similarity 0.27
CExpressionValueStack::Not 180257e08 -> 18025b4f0 code, length, address, calling, called similarity 0.36
CExpressionValueStack::Vector3TransformNormal 180259880 -> 18025dcd4 code, length, address, calling, called similarity 0.28
CExpressionValueStack::Quaternion 1802585c4 -> 18025be60 code, length, address, calling, called similarity 0.19
CExpression::CalculateValueWorker 180071850 -> 1800be5a0 code, refcount, length, address, called similarity 0.02
CExpressionValueStack::Matrix4x4FromRotationX 180256f4c -> 180259d74 code, length, address, calling, called similarity 0.24
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle EXTERNAL:0000008e refcount, calling similarity 1.0
CExpressionValueStack::Matrix3x2 1800dc588 -> 1800c2024 code, refcount, length, address, called similarity 0.56
CExpressionValueStack::Modulus 180257c20 -> 18025b200 code, length, address, calling, called similarity 0.3
CExpressionValueStack::Slerp 180258bf4 -> 18025c8e4 code, length, address, calling, called similarity 0.23
CExpressionValueStack::Floor 180255754 -> 180257b14 code, length, address, calling, called similarity 0.35
CPropertySet::operator_new 18010db60 -> 1800390ac code, refcount, length, address similarity 0.67
CExpressionValueStack::ColorRgb 1800eff78 -> 1800f32a4 code, refcount, length, address, called similarity 0.2
CExpressionValueStack::Matrix4x4FromScale 18025730c -> 18025a494 code, length, address, calling, called similarity 0.06
CExpressionValueStack::Tan 180258d80 -> 18025cbb8 code, length, address, calling, called similarity 0.36
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW EXTERNAL:00000067 refcount, calling similarity 1.0
CLineGeometry::operator_new 1800ffe54 -> 1801bc52c code, fullname, refcount, length, address, parent similarity 0.67
CPrimitiveGroup::ResolveSharedMemoryBufferOld 1800a7148 -> 180112950 name, fullname, refcount, length, sig, address similarity 1.0
FUN_18012109a 1801195c4 -> 18012109a code, name, fullname, length, sig, address similarity 0.97
CExpressionValue::CExpressionValue 1802750e0 -> 1800c26b4 code, name, fullname, refcount, length, sig, address, calling, called, parent similarity 0.14
View full diff report View RCA report Download PoC

Attack Path

Heap overflow in the DWM command buffer - the allocation rounds down, the copy does not

Attack path for CVE-2024-30051 Heap overflow in the DWM command buffer - the allocation rounds down, the copy does not 01 — ENTRY Attacker drives DirectComposition to build a command buffer Standard user; DWM runs as SYSTEM and processes composition commands from any desktop session process. 02 — CONTROLLED INPUT Chooses a shared-buffer size that is not a multiple of 0x90 CD2DSharedBuffer::GetBufferSize returns the attacker-influenced size. Any value with a non-zero remainder mod 0x90 produces overflow; the remainder is the overflow length. 03 — PATH CCommandBuffer::Initialize allocates the destination and copies into it GetBufferSize is called twice, returning the same value into buffer_size and buffer_size2. 04 — MISSING CHECK Allocation uses (buffer_size / 0x90) * 0x90, the memcpy uses the unrounded buffer_size2 Integer division truncation makes size_new smaller than the copy length by up to 0x8F bytes. The patch sizes the allocation from the same value used for the copy. 05 — PRIMITIVE Heap overflow of 1 to 0x8F attacker-chosen bytes inside the SYSTEM DWM process Short, precisely controlled overflow into an adjacent heap chunk. Exploited in the wild by QakBot operators.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

2 public PoCs
RepositoryStarsPublishedDescription
fortra/CVE-2024-30051 124 2024-08-14
devianntsec/CVE-2024-30051 1 2026-03-25 Master's Thesis research on CVE-2024-30051 (Windows DWM Heap Overflow). Features a high-reliability exploit with automated heap spray optimization, real-time logging, and empirical success-rate analys

Detection Rules

Acknowledgments

Vlad Stolyarov and Benoit Sevens of Google Threat Analysis Group Bryce Abdo and Adam Brunner of Google Mandiant
Quan Jin
Mert Degirmenci

On This Page