CVE-2024-30051

What it actually does

CVE-2024-30051 is a local elevation-of-privilege vulnerability in the Windows Desktop Window Manager Core Library. An attacker who already has code execution as a low-privileged local user can trigger memory corruption in DWM-related components and elevate privileges, potentially executing code with SYSTEM-level authority. Because the CVSS vector is local, low-complexity, requires low privileges, and requires no user interaction, it is most relevant as a post-compromise privilege-escalation primitive used after initial access.

Why it matters to the business

Successful exploitation can turn an initial foothold on a Windows workstation or server into full administrative control of that system. That can enable credential theft, disabling security tools, lateral movement, data theft, and ransomware deployment. This vulnerability is in CISA KEV, has confirmed active exploitation, and is flagged as used in ransomware campaigns, so unpatched Windows 10, Windows 11, and Windows Server systems should be treated as high-priority remediation targets despite the vulnerability requiring local access.

How an attack unfolds

An attacker first gains low-privileged access to a Windows system through another technique such as phishing, malware execution, stolen credentials, exposed remote access, or exploitation of a separate vulnerability. Once running locally, the attacker executes exploit code that interacts with the Desktop Window Manager Core Library and triggers the memory-corruption condition. If exploitation succeeds, the attacker obtains elevated privileges, commonly SYSTEM-level execution, and can then perform post-exploitation actions such as dumping credentials, tampering with endpoint defenses, installing persistence, moving laterally, staging payloads, or deploying ransomware. Public reporting and KEV inclusion indicate this flaw has been exploited in the wild, so defenders should assume it may be chained with initial-access malware rather than used as a standalone internet-facing exploit.

How to fix it

Install the Microsoft security updates released on or after the May 2024 Patch Tuesday for all affected Windows versions, including Windows 10 1507, 1607, 1809, 21H2, 22H2; Windows 11 21H2, 22H2, 23H2; Windows Server 2016, 2019, and 2022. Because no product-specific fixed version list was provided, use Microsoft Update, WSUS, Microsoft Update Catalog, or Microsoft Security Update Guide to confirm that the applicable May 2024 cumulative update or a later cumulative update is installed for each OS build. Prioritize internet-adjacent systems, administrator workstations, jump hosts, VDI/session hosts, servers used by privileged users, and endpoints with evidence of malware. Where immediate patching is not possible, reduce exposure by limiting interactive logon and RDP access, enforcing least privilege, applying application control, enabling tamper protection and EDR, restricting untrusted executables, and isolating high-risk unpatched systems until updates can be applied.

How to confirm the fix worked

Confirm that each affected Windows system has installed the applicable May 2024 cumulative security update or a later cumulative update. Validate through Windows Update history, enterprise patch management, PowerShell inventory, or vulnerability scanning. Check the OS build and installed hotfix inventory rather than relying only on reboot status. After patching, reboot systems as required and rescan to ensure the vulnerability no longer appears. For high-risk systems, verify that DWM-related binaries such as dwm.exe and dwmcore.dll are Microsoft-signed and match versions delivered by the installed cumulative update. Also review endpoint telemetry for post-patch exploit attempts or historical signs of pre-patch exploitation.

Typical attack path

1. Gain initial low-privileged access to a Windows endpoint or server.
2. Run a local exploit targeting the Windows DWM Core Library vulnerability.
3. Trigger memory corruption in the DWM component to escape the original low-privileged context.
4. Obtain elevated privileges, potentially SYSTEM-level code execution.
5. Disable or tamper with security controls, collect credentials, or establish persistence.
6. Use elevated access for lateral movement, data theft, payload staging, or ransomware deployment.

How to detect it

Investigate whether this vulnerability was already exploited by correlating endpoint, Windows event, crash, and EDR telemetry around the time of suspicious user-level execution. Key log sources include Windows Security logs for process creation and privilege assignment, Sysmon process and image-load events, Windows Error Reporting and Application logs for DWM crashes, Microsoft Defender or EDR alerts, PowerShell logs, terminal services logs, and patch-management records. Look for low-privileged processes followed shortly by SYSTEM-level shells, suspicious service creation, credential dumping, security-tool tampering, or ransomware staging. DWM exploitation may leave crash artifacts such as dwm.exe or dwmcore.dll access violations, but absence of a crash does not prove absence of exploitation. Prioritize hosts that were unpatched after 2024-05-14, especially those with malware detections, unusual privilege transitions, or signs of ransomware pre-positioning.

• C:\Windows\System32\dwm.exe
• C:\Windows\System32\dwmcore.dll
• Faulting application name: dwm.exe
• Faulting module name: dwmcore.dll
• Exception code: 0xc0000005
• Windows Error Reporting
• Application Error
• Event ID 1000
• Event ID 1001
• ParentImage: C:\Windows\System32\dwm.exe
• Parent process: C:\Windows\System32\dwm.exe
• dwm.exe -> cmd.exe
• dwm.exe -> powershell.exe
• dwm.exe -> pwsh.exe
• dwm.exe -> wscript.exe
• dwm.exe -> cscript.exe
• dwm.exe -> rundll32.exe
• dwm.exe -> regsvr32.exe
• dwm.exe -> mshta.exe
• dwm.exe -> certutil.exe
• dwm.exe -> bitsadmin.exe
• dwm.exe -> schtasks.exe
• dwm.exe -> sc.exe
• dwm.exe -> net.exe
• dwm.exe -> net1.exe

What your security team should do

• Treat this as urgent because it is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware activity; CISA’s remediation deadline was 2024-06-04.
• Patch all affected Windows workstations and servers with the May 2024 cumulative update or later, prioritizing systems used by administrators and systems exposed to untrusted users.
• Hunt for evidence of local privilege escalation followed by credential access, defense evasion, persistence, lateral movement, or ransomware staging.
• Correlate DWM crashes or unusual DWM behavior with process creation, privilege changes, EDR alerts, and suspicious child processes.
• Review recent malware incidents where the initial process ran as a standard user but later obtained SYSTEM privileges without an expected administrative action.
• Enforce least privilege, restrict local administrator membership, harden RDP and remote management access, and use application control to reduce the usefulness of local privilege-escalation exploits.
• Ensure EDR, Microsoft Defender, PowerShell logging, command-line process logging, and Sysmon or equivalent telemetry are enabled on high-value Windows systems.