Loading vulnerability…
Microsoft Windows SmartScreen Prompt Security Feature Bypass
CVE-2024-29988 is a protection-mechanism failure in Microsoft Windows SmartScreen. A specially crafted malicious file can bypass SmartScreen prompt protections when a user launches it through a launcher application configured to suppress user-interface display. The flaw can permit execution of untrusted content without the expected SmartScreen warning.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses Microsoft Defender SmartScreen protections and can result in execution of attacker-supplied untrusted content. The vulnerability has been actively exploited in the wild, including activity attributed to Water Hydra.
If you can’t patch tonight, do this now.
Where patching cannot be completed immediately, use a controlled and phased deployment process, prioritize exposed and high-risk systems, and test updates in a representative environment before broad production rollout. Users should avoid launching untrusted files, particularly files delivered through download-based initial-access lures.
Patch, then assume compromise.
Apply Microsoft's April 9, 2024 security updates for all affected Windows client and server editions. Verify that the applicable update is installed against the Microsoft Update Guide entry for CVE-2024-29988.
1 exploit validated by Mallory's analysis. Hidden: 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.