Loading vulnerability…
Windows TCP/IP IPv6 Remote Code Execution Vulnerability
CVE-2024-38063 is a critical remote code execution vulnerability in the Windows TCP/IP stack. The flaw is triggered by processing specially crafted IPv6 network packets and affects supported Windows client and server platforms, including Server Core installations. Available reporting describes the issue as an integer underflow in the IPv6 handling path of the TCP/IP component. Exploitation does not require authentication or user interaction, making it a zero-click network attack surface vulnerability. Microsoft assessed exploitation as more likely, and multiple reports characterize the issue as potentially wormable because it can be reached remotely over the network via IPv6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution on the target Windows system, reportedly in the context of SYSTEM. Because the vulnerability is reachable remotely over the network without authentication or user interaction, compromise of an exposed vulnerable host could enable full system takeover, follow-on malware deployment, lateral movement, and potentially self-propagating attacks in environments where IPv6-reachable systems are present.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable IPv6 on systems where it is not operationally required, as exploitation is described as limited to IPv6-enabled hosts. Additional defensive measures include restricting unnecessary network exposure, monitoring for suspicious or malformed IPv6 traffic and extension-header activity, and using network segmentation to reduce the blast radius of a successful compromise. These measures are compensating controls and do not replace vendor patching.
Patch, then assume compromise.
Apply the Microsoft security updates released in August 2024 for all affected Windows and Windows Server versions. Prioritize patching internet-facing and otherwise network-reachable systems, especially those with IPv6 enabled. Ensure both client and server deployments, including Server Core installations, receive the relevant cumulative or security updates for their platform.
20 exploits validated by Mallory's analysis. Hidden: 6 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.