CVE-2024-30097 Overview
CVE-2024-30097 is a remote code execution vulnerability in the Microsoft Speech Application Programming Interface (SAPI). The flaw stems from a double free condition [CWE-415] in the SAPI component shipped with supported versions of Windows 10, Windows 11, and Windows Server. An attacker can trigger memory corruption that leads to arbitrary code execution in the context of the affected user. Exploitation requires user interaction, typically by convincing a target to open a crafted file or interact with malicious content that invokes the speech API.
Critical Impact
Successful exploitation grants attackers code execution with the privileges of the logged-on user, enabling full compromise of confidentiality, integrity, and availability on affected Windows endpoints and servers.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-06-11 - CVE-2024-30097 published to NVD and addressed in Microsoft's June 2024 Patch Tuesday
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-30097
Vulnerability Analysis
The vulnerability resides in the Microsoft Speech Application Programming Interface (SAPI), a Windows component that exposes text-to-speech and speech recognition functionality to applications. SAPI parses speech-related data structures and grammar files, and the affected code path mismanages heap memory during this processing.
An attacker who tricks a user into opening a specially crafted file or content that invokes SAPI can execute arbitrary code in the user context. Because SAPI is loaded by many client applications, the attack surface includes any process that consumes user-provided speech grammars, lexicons, or audio metadata.
The EPSS probability is approximately 4.06% with a percentile of 88.6, indicating elevated likelihood of exploitation activity relative to other published CVEs.
Root Cause
The root cause is a double free vulnerability [CWE-415], in which the same heap allocation is released twice during SAPI's handling of crafted input. Double free conditions corrupt the heap allocator's free list and can be leveraged to gain control of program execution flow, ultimately enabling arbitrary code execution.
Attack Vector
The attack vector is network-based but requires user interaction. An attacker delivers a malicious file or content (for example via email, web download, or a network share) that, when opened by a target with an application using SAPI, triggers the vulnerable code path. No prior authentication is required on the target system. Successful exploitation yields code execution at the privilege level of the invoking user.
No verified public proof-of-concept code is available. See the Microsoft Security Update CVE-2024-30097 advisory for vendor-supplied technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2024-30097
Indicators of Compromise
- Unexpected child processes spawned by applications that load sapi.dll or related SAPI components
- Crash events or Windows Error Reporting entries referencing SAPI modules following the opening of untrusted files
- Anomalous outbound network connections originating from processes that recently loaded SAPI libraries
Detection Strategies
- Monitor module loads of sapi.dll, sapisvr.exe, and related speech components by non-speech applications
- Alert on heap corruption exceptions in user-mode processes that consume external file formats invoking SAPI
- Correlate file open events for speech grammar (.grxml), lexicon, or audio metadata files with subsequent process anomalies
Monitoring Recommendations
- Track patch compliance for the June 2024 Microsoft security updates across all Windows 10, Windows 11, and Windows Server endpoints
- Enable command-line and process creation auditing (Event ID 4688) to capture suspicious child processes from SAPI-hosting applications
- Collect endpoint telemetry into a centralized data lake for retrospective hunting on SAPI module activity
How to Mitigate CVE-2024-30097
Immediate Actions Required
- Apply the June 2024 Microsoft security update referenced in the Microsoft Security Update CVE-2024-30097 advisory to all affected Windows systems
- Prioritize patching for user-facing endpoints where document and media files are routinely opened
- Restrict the opening of untrusted files received via email, web, or removable media until patches are verified
Patch Information
Microsoft released a security update on June 11, 2024 that addresses the double free condition in SAPI. Administrators should deploy the cumulative update for their specific Windows build via Windows Update, Windows Server Update Services (WSUS), or their endpoint management platform. Verify installation by confirming the corresponding KB article is present in installed updates.
Workarounds
- No official vendor workaround is published; applying the security update is the supported remediation
- Apply Attack Surface Reduction (ASR) rules to block execution of content from email and webmail clients as a defense-in-depth measure
- Enforce least-privilege user accounts so successful exploitation does not yield administrative access
# Verify patch status on Windows hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Confirm Windows build is current
[System.Environment]::OSVersion.Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
