CVE-2024-38264: Microsoft Windows 11 22H2 VHDX DoS Flaw

CVE-2024-38264 Overview

CVE-2024-38264 is a denial of service vulnerability affecting the Microsoft Virtual Hard Disk (VHDX) component in Windows 11 and Windows Server 2022/2025. An unauthenticated attacker can trigger a condition that disrupts the availability of the affected system without requiring user interaction. The vulnerability is classified under [CWE-591] (sensitive data storage in improperly locked memory) and impacts availability only, with no impact on confidentiality or integrity. Microsoft published guidance and a security update through the Microsoft Security Response Center.

Critical Impact
Successful exploitation causes a denial of service condition on affected Windows 11 and Windows Server hosts that process attacker-supplied VHDX content over the network.

Affected Products

Microsoft Windows 11 (22H2, 23H2, 24H2) on x64 and ARM64
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2024-11-12 - CVE-2024-38264 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38264

Vulnerability Analysis

The flaw resides in the Windows VHDX parsing and mount logic used by the Virtual Hard Disk subsystem. VHDX is Microsoft's virtual disk container format used by Hyper-V and native Windows disk mounting features. When the affected component processes a malformed or crafted VHDX structure, it enters a state that exhausts resources or halts service, producing a denial of service condition. The attack vector is network based, but exploitation requires high attack complexity and specific conditions to reliably trigger the fault. No authentication or user interaction is required to attempt exploitation.

Root Cause

The vulnerability is associated with [CWE-591], indicating improper handling of data stored in memory that is not adequately locked or protected. In practice, this class of bug in a disk-image parser typically results from insufficient validation of structural fields within the VHDX container before the data is consumed by kernel-mode components.

Attack Vector

An attacker delivers a crafted VHDX image to a target system that mounts, opens, or otherwise parses the virtual disk. Delivery paths include network shares, remote file services, and virtualization workflows that ingest untrusted VHDX files. Once the malformed structure is processed, the vulnerable code path halts virtual disk services or the host, producing the denial of service outcome.

No public proof-of-concept code is available. Microsoft has not disclosed technical implementation details. Refer to the Microsoft Security Update for CVE-2024-38264 for authoritative product-level details.

Detection Methods for CVE-2024-38264

Indicators of Compromise

Unexpected termination or hang of the Virtual Disk Service (vds.exe) or Hyper-V Virtual Machine Management service (vmms.exe) on affected hosts.
System event log entries recording bug checks or crashes correlated with VHDX mount operations from network sources.
Repeated inbound SMB or WebDAV requests referencing .vhdx files from untrusted origins before the fault occurs.

Detection Strategies

Correlate Windows kernel and storage subsystem crash events with recent VHDX file access from remote paths.
Monitor for anomalous file share activity where untrusted users deliver .vhdx payloads to systems that auto-mount virtual disks.
Build behavioral alerts for process crashes affecting vds.exe, vmms.exe, or vhdmp.sys load failures.

Monitoring Recommendations

Enable and forward Windows System, Application, and Hyper-V-VMMS event logs to a central data lake for correlation.
Track network file access to VHDX artifacts using EDR file-open telemetry and SMB access logs.
Alert on repeated service restarts of storage and virtualization components across the fleet.

How to Mitigate CVE-2024-38264

Immediate Actions Required

Apply the Microsoft security update for CVE-2024-38264 to all affected Windows 11 and Windows Server 2022/2025 systems.
Inventory hosts that mount VHDX files from network locations and prioritize patching for exposed virtualization hosts.
Restrict inbound SMB and WebDAV access from untrusted networks to reduce the delivery surface for crafted VHDX files.

Patch Information

Microsoft has issued a security update addressing the vulnerability. Consult the Microsoft Security Update Guide for CVE-2024-38264 for the specific KB numbers and cumulative update packages matching each affected build. Deploy via Windows Update, WSUS, Microsoft Update Catalog, or your patch management platform.

Workarounds

Block or filter SMB (TCP/445) and WebDAV traffic originating from untrusted networks at the perimeter and host firewall.
Disable automatic mounting of virtual disk files delivered from network paths where operationally feasible.
Limit Hyper-V and virtual disk management privileges to trusted administrators until patches are deployed.

bash

# Configuration example: block inbound SMB from untrusted sources on affected hosts
New-NetFirewallRule -DisplayName "Block-Untrusted-SMB-VHDX" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -RemoteAddress Any -Action Block