Loading vulnerability…
Remote Code Execution in Windows Imaging Component via Malicious TIFF Upload
CVE-2024-38060 is a remote code execution vulnerability in Microsoft Windows Imaging Component. The flaw is triggered when the vulnerable component processes a specially crafted TIFF image file. Available reporting indicates exploitation involves an authenticated attacker uploading a malicious TIFF file to a vulnerable server, after which processing of that image can result in execution of attacker-controlled code. The vulnerability has been described with a CVSS score of 8.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution on the vulnerable server in the context of the affected application or service that processes the malicious TIFF content. This can allow an attacker to run arbitrary code, potentially leading to compromise of the target system, deployment of additional payloads, data access, or further post-exploitation activity depending on the privileges of the processing context.
If you can’t patch tonight, do this now.
Until patches can be applied, reduce exposure by restricting which authenticated users can upload files to affected servers, limiting or disabling TIFF upload and processing where operationally feasible, and isolating services that handle untrusted image content. Additional defensive measures include validating and sanitizing uploaded files before processing, using application-layer controls to block or quarantine TIFF content from untrusted sources, and minimizing the privileges of services that invoke Windows Imaging Component.
Patch, then assume compromise.
Apply the Microsoft security updates released for CVE-2024-38060 as part of the July 2024 Patch Tuesday cycle to all affected Windows systems and servers using Windows Imaging Component. Prioritize systems that accept or process uploaded image content, especially TIFF files, and verify that the relevant Microsoft updates have been successfully deployed across exposed workloads.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.