CVE-2024-49117

HIGH

Published Dec 12, 2024 Modified Jan 14, 2025 CWE-393

Description

Windows Hyper-V Remote Code Execution Vulnerability

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-393 CWE-393

Affected Products

Vendor	Product	Versions
microsoft	windows_11_22h2	< 10.0.22621.4602
microsoft	windows_11_23h2	< 10.0.22631.4602
microsoft	windows_11_24h2	< 10.0.26100.2605
microsoft	windows_server_2022	< 10.0.20348.2966
microsoft	windows_server_2022_23h2	< 10.0.25398.1308
microsoft	windows_server_2025	< 10.0.26100.2605

References

Advisories & Patches

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49117

Frequently Asked Questions

What is CVE-2024-49117? +

Windows Hyper-V Remote Code Execution Vulnerability It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2024-49117? +

CVE-2024-49117 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-49117? +

CVE-2024-49117 affects products from microsoft, specifically: windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2022, windows_server_2022_23h2, windows_server_2025. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-49117? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42246

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a …

CVE-2026-9058

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") …

CVE-2025-5987 8.1

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to …

CVE-2026-53092 7.8

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg …

CVE-2026-55958 7.5

Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag …

CVE-2025-32414 5.6

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because …