CVE-2024-38028 Overview
CVE-2024-38028 is a remote code execution vulnerability in the Microsoft Windows Performance Data Helper (PDH) library. The flaw is classified as an out-of-bounds read [CWE-125] affecting supported versions of Windows 10, Windows 11, and Windows Server. An authenticated attacker with high privileges on the network can trigger the condition to execute arbitrary code in the context of the vulnerable process. Microsoft addressed the issue in its July 2024 security updates. The vulnerability affects a broad estate of Windows releases spanning legacy Windows Server 2008 through Windows Server 2022 23H2.
Critical Impact
Successful exploitation results in remote code execution with high impact to confidentiality, integrity, and availability across affected Windows and Windows Server versions.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-38028 published to the National Vulnerability Database
- 2024-07-09 - Microsoft releases security update addressing the vulnerability
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-38028
Vulnerability Analysis
The vulnerability resides in the Windows Performance Data Helper (PDH) library, pdh.dll. This library exposes APIs used by applications and services to collect Windows performance counter data. The weakness is an out-of-bounds read [CWE-125] in which the PDH code reads past the end of an allocated buffer while processing performance counter input.
An attacker who supplies malformed performance counter data to a service that consumes the PDH APIs can drive the library to read memory outside intended bounds. In this vulnerability, the condition is reachable in a way that permits code execution rather than only information disclosure. The attack is network-reachable but requires the attacker to already hold high privileges on the target, which limits opportunistic exploitation.
Root Cause
The root cause is missing or insufficient bounds validation in PDH parsing routines. When counter query structures or path strings are processed without validating length or index fields against buffer boundaries, subsequent memory reads fall outside allocated regions and corrupt program state used in later control-flow decisions.
Attack Vector
Exploitation requires authenticated network access and elevated privileges on the target system. A privileged attacker crafts malicious performance counter data or a specially formed request to a service that consumes PDH APIs. Processing the input triggers the out-of-bounds read and permits arbitrary code execution in the process context. See the Microsoft Security Update Guide for CVE-2024-38028 for vendor-supplied technical details.
// No verified public proof-of-concept is available for CVE-2024-38028.
// Refer to the Microsoft Security Update Guide for technical details.
Detection Methods for CVE-2024-38028
Indicators of Compromise
- Unexpected crashes or exceptions in processes that load pdh.dll, especially perfmon.exe, wmiprvse.exe, and monitoring agents.
- Anomalous performance counter queries originating from authenticated but non-administrative accounts attempting to reach privileged service contexts.
- New or unsigned child processes spawned by services that consume PDH APIs shortly after receiving remote performance queries.
Detection Strategies
- Hunt for process crashes with faulting module pdh.dll in Windows Error Reporting (WER) telemetry.
- Correlate authenticated remote sessions with subsequent process creation from performance-monitoring services.
- Alert on unexpected loads of pdh.dll by non-standard processes or from writable, user-controlled paths.
Monitoring Recommendations
- Enable command-line and process-creation auditing (Event ID 4688) on servers exposing management or monitoring services.
- Forward Sysmon Event ID 7 (image load) and Event ID 11 (file create) for pdh.dll and related modules to a centralized SIEM.
- Review Windows Event Log entries for the PerfNet, PerfOS, and PerfProc providers for parsing errors or repeated failures.
How to Mitigate CVE-2024-38028
Immediate Actions Required
- Apply the July 2024 Microsoft security updates that address CVE-2024-38028 to all affected Windows and Windows Server systems.
- Inventory systems running unsupported or legacy Windows Server 2008 and 2012 releases and prioritize patching or isolation.
- Restrict remote access to performance monitoring interfaces and require least-privilege administrative accounts.
Patch Information
Microsoft published the fix in its July 2024 Patch Tuesday cycle. Consult the Microsoft Security Update Guide for CVE-2024-38028 for the specific KB articles that apply to each affected build. Apply the update via Windows Update, WSUS, or the standalone MSU packages listed by Microsoft.
Workarounds
- Where patching is delayed, restrict inbound network access to services that expose PDH functionality using host firewall rules.
- Enforce strict role separation so accounts capable of issuing remote performance queries do not overlap with high-value administrative identities.
- Monitor and alert on privileged account use of performance counter APIs from remote sources until updates are deployed.
# Verify the July 2024 cumulative update is installed (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Block inbound WMI/RPC access from untrusted networks as a compensating control
New-NetFirewallRule -DisplayName "Restrict WMI-In" -Direction Inbound -Protocol TCP -LocalPort 135 -RemoteAddress <trusted-subnet> -Action Allow
New-NetFirewallRule -DisplayName "Block WMI-In Default" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
