CVE-2024-30077 Overview
CVE-2024-30077 is a remote code execution vulnerability in Windows Object Linking and Embedding (OLE). The flaw affects a wide range of Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2008 through 2022. Microsoft classifies the issue as a heap-based buffer overflow [CWE-122] reachable over the network. Successful exploitation requires user interaction and low-privileged authentication, and can result in full compromise of confidentiality, integrity, and availability on the target host.
Critical Impact
An authenticated attacker can trick a user into opening a crafted file or OLE object to execute arbitrary code in the context of the victim and pivot deeper into the environment.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-06-11 - CVE-2024-30077 published to NVD as part of Microsoft's June 2024 Patch Tuesday
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2024-30077
Vulnerability Analysis
The vulnerability resides in the Windows OLE component, a legacy technology used to embed and link documents and other objects across applications. Microsoft's advisory identifies the underlying weakness as a heap-based buffer overflow [CWE-122]. An attacker who supplies a malformed OLE object can corrupt heap memory during parsing and hijack execution flow.
The attack is network-reachable but requires user interaction. A common delivery path is a crafted Office document, RTF file, or email message containing an embedded OLE object. When the target opens the file, OLE parsing triggers the overflow. Because OLE runs in-process with the host application, successful exploitation gives the attacker code execution in the security context of the current user.
Root Cause
The root cause is improper validation of size or length fields when the OLE subsystem allocates and populates heap buffers for embedded object data. Attacker-controlled input drives a write past the allocated buffer boundary, corrupting adjacent heap metadata or function pointers. This condition maps directly to [CWE-122] heap-based buffer overflow.
Attack Vector
Exploitation requires an authenticated user on the target system to open or preview a malicious document, email, or embedded object. Common vectors include phishing emails with weaponized attachments, malicious files hosted on internal shares, and content rendered by Office applications that invoke OLE. Once code execution is achieved, attackers typically deploy loaders, credential theft tooling, or persistence mechanisms.
No public proof-of-concept exploit is currently listed for CVE-2024-30077, and CISA has not added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 1.802% places the vulnerability in the 76th percentile, indicating meaningful exploitation likelihood relative to other CVEs. See the Microsoft Security Update for CVE-2024-30077 for authoritative technical guidance.
Detection Methods for CVE-2024-30077
Indicators of Compromise
- Office or Explorer processes (WINWORD.EXE, OUTLOOK.EXE, explorer.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
- Crashes or unusual heap-related exceptions in processes loading ole32.dll or oleaut32.dll.
- Inbound email attachments or downloaded files containing embedded OLE objects with malformed size fields.
Detection Strategies
- Monitor for anomalous process lineage originating from document handlers, especially processes injecting into or launching from OLE-enabled applications.
- Inspect email gateway telemetry for attachments containing OLE streams and correlate with sender reputation and user click activity.
- Hunt for post-exploitation behaviors including LSASS access, suspicious scheduled task creation, and outbound C2 traffic from user workstations.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and executable content from email.
- Ingest Windows Sysmon events (Event IDs 1, 7, 11) and Office telemetry into a SIEM or data lake to baseline normal OLE behavior.
- Alert on unsigned or LOLBin binaries executing shortly after a user opens a document from an external source.
How to Mitigate CVE-2024-30077
Immediate Actions Required
- Deploy the June 2024 Microsoft security updates addressing CVE-2024-30077 across all affected Windows client and server SKUs.
- Prioritize patching of user endpoints, RDS/Citrix hosts, and any server running interactive user sessions with Office.
- Reinforce user awareness on opening unsolicited attachments and enable Protected View for documents originating from the internet.
Patch Information
Microsoft released fixes as part of the June 2024 Patch Tuesday cycle. Consult the Microsoft Security Update for CVE-2024-30077 for the specific KB articles applicable to each Windows version and Server release.
Workarounds
- Block or strip inbound email attachments containing OLE objects at the mail gateway where feasible.
- Disable OLE object activation in Microsoft Office via Trust Center policy for high-risk user groups until patches are applied.
- Enforce Windows Defender Application Control (WDAC) or AppLocker policies to restrict execution of unsigned binaries spawned by Office processes.
# Configuration example: enable Microsoft Defender ASR rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
