Windows SMB Denial of Service Vulnerability

published 2024-11-12 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-40387

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 63.1%; EPSS 63.1% chance of exploitation in 30 days, percentile 99.2%
public exploits: 0; none known

Patch / fix

fixed in 8 links 1

Microsoft Windows Server 2025 10.0.26100.2314
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.2314
Microsoft Windows Server 2022 10.0.20348.2849
Microsoft Windows 11 version 22H2 10.0.22621.4460
Microsoft Windows 11 version 22H3 10.0.22631.4460
Microsoft Windows 11 Version 23H2 10.0.22631.4460
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1251
Microsoft Windows 11 Version 24H2 10.0.26100.2314

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43642 advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-11-13)

Exploit prediction

63.08% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Microsoft Windows Server 2025
Microsoft Windows Server 2025 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows 11 version 22H2
Microsoft Windows 11 version 22H3
Microsoft Windows 11 Version 23H2
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows 11 Version 24H2

Classification

Weakness

CWE-416 Use After Free

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2024-43642
vendor-advisory, patch

Sources

CVE List CVE-2024-43642
NVD CVE-2024-43642

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary