Loading vulnerability…
Remote Code Execution in Windows Network Address Translation (NAT)
CVE-2024-38119 is a critical remote code execution vulnerability in the Windows Network Address Translation (NAT) component. The flaw is described as a use-after-free condition in the Windows NAT implementation, where memory that has already been released can subsequently be accessed in a way that enables attacker-controlled corruption of program state. Successful exploitation can result in execution of arbitrary code in the context of the vulnerable Windows networking component. Microsoft assessed the issue as requiring adjacent network access and noted that exploitation requires the attacker to be on the same network segment as the target system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow remote code execution on a vulnerable Windows system through the NAT component. Because the flaw is in a core networking feature, compromise could enable full system takeover depending on the execution context of the affected service, as well as follow-on actions such as persistence, lateral movement, or disruption of network services on the affected host.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by limiting adjacent-network access to affected hosts, segmenting networks to prevent untrusted systems from reaching vulnerable NAT-enabled machines, and restricting use of the Windows NAT feature where operationally feasible. Additional defensive measures include minimizing attack surface on internal network boundaries and monitoring for anomalous traffic targeting NAT-enabled Windows hosts.
Patch, then assume compromise.
Apply the September 2024 Microsoft security updates for supported affected Windows versions that include fixes for CVE-2024-38119. Prioritize patching systems that expose or rely on the Windows NAT feature in environments where untrusted or semi-trusted hosts share the same network segment. If legacy platforms are in use, verify vendor support status because reporting indicates some older Windows Server versions did not receive a patch for this issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.