Microsoft releases May 2024 patch, fixes one critical issue, two zero-days, 61 flaws

Microsoft's May 2024 Patch Tuesday is addressing a total of 61 security flaws, including one critical issue and two zero-day vulnerabilities.

The critical flaw is a a Remote Code Execution (RCE) vulnerability in Microsoft SharePoint Server tracked as CVE-2024-30044 (CVSS score 8.8). This vulnerability requires the attacker to be authenticated and have Site Owner permissions or higher on a vulnerable SharePoint Server. Once these conditions are met, the attacker could exploit the vulnerability to perform actions such as reading local files, executing server-side request forgery (SSRF), and potentially relaying NTLM sessions, posing significant risks to the integrity and confidentiality of the system.

The two zero-days are CVE-2024-30051and CVE-2024-30040.

CVE-2024-30051 (CVSS score 7.8) is a heap-based buffer overflow in the Windows DWM Core Library, which could allow an attacker to gain SYSTEM privileges. This vulnerability has been associated with Qakbot and other malware in use by multiple threat actors.

CVE-2024-30040 (CVSS score 8.8) is a security feature bypass in the Microsoft MSHTML Platform, enabling attackers to circumvent OLE (Object Linking and Embedding) protections in Microsoft 365 and Office. To exploit this vulnerability, attackers must deceive a user into manipulating a malicious file without necessarily opening it, leading to arbitrary code execution in the user's context.

The total count of 61 flaws does not include vulnerabilities in Microsoft Edge, patched earlier in the month.

Full list of vulnerabilities patched