{"id":"CVE-2024-21351","published":"2024-02-13T18:15:51Z","modified":"2026-08-10T16:18:42Z","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows SmartScreen Security Feature Bypass Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a security feature bypass in Microsoft Windows SmartScreen, the component that checks downloaded and untrusted content. An attacker can exploit it remotely over the network with no privileges or authentication, but the attack requires a user to interact with a crafted item, and it stems from improper control over code generation (code injection).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:24Z"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.27798,"percentile":0.98088,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-02-13","dueDate":"2024-03-05","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351; https://nvd.nist.gov/vuln/detail/CVE-2024-21351","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-13","exploitedFirstSeen":"2024-02-13","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Feb","date":"2024-02-13"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","date":"2024-02-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-13"},{"url":"https://ti.qianxin.com/uploads/2024/08/19/2274f632f6a1d8acd2f1801c24887edb.pdf","date":"2024-08-19"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"},{"url":"https://www.cert.europa.eu/publications/threat-intelligence/tlr2024/pdf","date":"2025-02-25"},{"url":"https://www.uscg.mil/Portals/0/Images/cyber/CGCYBER%202024%20CTIME.pdf","date":"2025-05-19"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21351","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: requires user to open malicious file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass Vulnerability","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-impairment"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: bypasses Mark-of-the-Web protection","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass","start":0,"end":43}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19063","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19063","exploited":true,"exploitedSince":"2024-02-13","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1553.005"],"provenance":"ai"}],"timeline":[{"date":"2024-02-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21351","provenance":"source"},{"date":"2024-02-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Feb","provenance":"source"},{"date":"2024-02-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19063","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":62.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 990 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9809"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.32,"detail":"base score 7.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-94"}}