CVE-2024-38104: Windows 10 1507 Fax Service RCE Flaw

CVE-2024-38104 Overview

CVE-2024-38104 is a remote code execution vulnerability in the Windows Fax Service. Microsoft disclosed the flaw on July 9, 2024 as part of its monthly security update cycle. The weakness maps to [CWE-822] Untrusted Pointer Dereference and [CWE-119] Improper Restriction of Operations within the Bounds of a Memory Buffer.

An authenticated attacker on the network can trigger memory corruption in the Fax Service to execute arbitrary code. Successful exploitation results in high impact to confidentiality, integrity, and availability on the target host. The vulnerability affects a wide range of Windows client and server versions still supported at the time of publication.

Critical Impact
Successful exploitation allows a low-privileged network attacker to execute code in the context of the Windows Fax Service, leading to full compromise of the target system.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and Server 2022 23H2

Discovery Timeline

2024-07-09 - CVE-2024-38104 published to NVD and addressed in Microsoft's July 2024 Patch Tuesday release
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38104

Vulnerability Analysis

The Windows Fax Service (fxssvc.exe) handles fax transmission requests through remote procedure call (RPC) interfaces and processes structured message data supplied by clients. CVE-2024-38104 arises when the service dereferences a pointer sourced from attacker-controlled input without proper validation.

An attacker with valid low-privileged credentials on the network can send crafted requests that cause the service to interpret malicious data as a trusted pointer. The condition leads to memory corruption within the service process. Because the Fax Service runs with elevated privileges, code executed through this flaw operates with substantially more access than the attacker's original session.

Root Cause

The root cause combines an untrusted pointer dereference ([CWE-822]) with improper bounds checking on buffer operations ([CWE-119]). The service accepts data structures that contain embedded pointer values or offsets and uses them during message processing without confirming they reference valid, service-owned memory. This design allows an attacker to redirect execution flow or corrupt adjacent structures on the heap.

Attack Vector

Exploitation requires network access and low-privileged authentication to the target. No user interaction is required. The attacker sends specially crafted RPC traffic to the Fax Service endpoint on a host where the service is enabled. Windows Server installations that share fax capabilities across a network and workstations with Fax and Scan features enabled represent the primary exposure. Refer to the Microsoft CVE-2024-38104 Update Guide for authoritative product and build details.

Detection Methods for CVE-2024-38104

Indicators of Compromise

Unexpected crashes, restarts, or child processes spawned by fxssvc.exe
New or unusual RPC connections to the Fax Service from remote hosts outside normal administrative ranges
Fax Service log entries referencing malformed message structures or truncated transmission data
Creation of scheduled tasks, services, or persistence artifacts immediately following Fax Service activity

Detection Strategies

Monitor process ancestry for fxssvc.exe spawning shells such as cmd.exe, powershell.exe, or rundll32.exe
Alert on module loads into fxssvc.exe from user-writable directories
Correlate authentication events with subsequent RPC traffic to the Fax Service to identify lateral movement patterns

Monitoring Recommendations

Enable Windows Event Log collection for the Fax Service and forward to a centralized log platform
Track patch state of the affected Windows versions across the estate and flag hosts missing the July 2024 cumulative update
Monitor for enablement of the Fax Service on systems where it is not required for business operations

How to Mitigate CVE-2024-38104

Immediate Actions Required

Apply the July 2024 Microsoft security update to all affected Windows client and server versions
Inventory hosts running the Fax Service and prioritize patching on internet-adjacent or multi-user systems
Restrict network access to Fax Service endpoints through host firewall rules and network segmentation

Patch Information

Microsoft released fixes for CVE-2024-38104 as part of the July 9, 2024 security update cycle. Refer to the Microsoft CVE-2024-38104 Update Guide for the specific KB article and build number applicable to each Windows release.

Workarounds

Disable the Windows Fax Service (fxssvc) on systems where fax functionality is not required
Remove the Fax and Scan optional feature from Windows client installations that do not use it
Block inbound RPC traffic to Fax Service endpoints from untrusted network segments using host or perimeter firewalls

bash

# Disable and stop the Windows Fax Service using PowerShell
Stop-Service -Name fxssvc -Force
Set-Service -Name fxssvc -StartupType Disabled