CVE-2024-21372: Windows 10 1507 OLE RCE Vulnerability

CVE-2024-21372 Overview

CVE-2024-21372 is a remote code execution vulnerability in Microsoft Windows Object Linking and Embedding (OLE). The flaw affects a wide range of Windows client and server releases, from Windows 10 1507 through Windows 11 23H2, and Windows Server 2008 through Server 2022 23H2. Microsoft tracks the root cause under [CWE-190] integer overflow or wraparound. Successful exploitation requires user interaction over the network and yields high impact to confidentiality, integrity, and availability. The Exploit Prediction Scoring System (EPSS) places this issue in the 75th percentile of likelihood of exploitation.

Critical Impact
An attacker who convinces a user to open a malicious document or OLE-embedded content can execute arbitrary code in the context of the current user.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and Server 2022 23H2

Discovery Timeline

2024-02-13 - CVE-2024-21372 published to the National Vulnerability Database
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2024-21372

Vulnerability Analysis

The vulnerability resides in the Windows OLE subsystem, which allows applications to embed and link compound documents and objects across processes. Microsoft classifies the defect as an integer overflow [CWE-190]. An attacker crafts an OLE object whose size or count fields overflow internal length calculations during parsing. The overflow leads to undersized buffer allocation followed by oversized writes, producing memory corruption and arbitrary code execution in the host process.

The attack requires user interaction. Typical delivery vectors include Office documents, RTF content, HTML email, or any file format that instantiates OLE objects on open. Code runs at the privilege level of the user who opens the document.

Root Cause

The defect is an arithmetic overflow during size validation of OLE object data. When malformed length values wrap around standard integer boundaries, downstream allocators reserve a buffer smaller than the data that will be copied. The subsequent copy operation corrupts adjacent heap structures, enabling control over execution flow.

Attack Vector

The network attack vector means the payload can be delivered through email attachments, file shares, or web downloads. Exploitation requires a victim to open the crafted content in an application that instantiates OLE. No prior authentication on the target is required, and the scope remains unchanged at the OLE host process.

No public proof-of-concept has been published. Refer to the Microsoft Security Response Center advisory for vendor technical details.

Detection Methods for CVE-2024-21372

Indicators of Compromise

Office or WordPad processes (winword.exe, excel.exe, wordpad.exe) spawning command interpreters such as cmd.exe, powershell.exe, or rundll32.exe
Unexpected crashes referencing ole32.dll, oleaut32.dll, or combase.dll in Windows Error Reporting
Inbound documents containing embedded OLE streams with anomalously large or malformed size headers

Detection Strategies

Hunt for child-process chains where an Office or document-rendering host spawns scripting or LOLBin processes immediately after opening a file
Inspect mail and web gateway telemetry for documents with embedded OLE objects originating from untrusted senders
Correlate application crashes in OLE-related modules with subsequent process creations on the same host

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from creating executable content
Forward Sysmon Event ID 1 (process creation) and Event ID 11 (file create) for Office and document-viewer processes to a central analytics platform
Track Windows Event 1000 and 1001 (application crashes) referencing OLE modules for triage

How to Mitigate CVE-2024-21372

Immediate Actions Required

Apply the February 2024 Microsoft security updates referenced in the MSRC advisory for CVE-2024-21372 to every affected Windows client and server
Prioritize patching of internet-facing and user-facing endpoints where documents are routinely opened
Validate that endpoint protection signatures and behavioral rules for OLE exploitation are current

Patch Information

Microsoft released fixes as part of the February 13, 2024 Patch Tuesday release. Each affected SKU has a dedicated update package linked from the Microsoft Security Update Guide entry for CVE-2024-21372. Administrators should deploy updates through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

Block macro and OLE object execution in Microsoft Office using Group Policy or Intune administrative templates
Use Protected View and Office File Block policies to prevent untrusted documents from instantiating embedded objects
Restrict inbound email attachments and web downloads containing high-risk file types at the perimeter

bash

# Configuration example: enforce Office ASR rules that limit OLE-related child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office from creating executable content
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled