CVE-2024-43458: Windows 10 1607 Information Disclosure

CVE-2024-43458 Overview

CVE-2024-43458 is a Windows Networking information disclosure vulnerability affecting Microsoft Windows 10 version 1607 and Windows Server 2016. The flaw is classified under CWE-908: Use of Uninitialized Resource. An authenticated network-adjacent attacker can leverage uninitialized memory in Windows networking components to read sensitive data belonging to other users or processes. The vulnerability carries a confidentiality-only impact with a scope change, meaning disclosed data can cross security boundaries. Microsoft addressed the issue in the September 2024 security update cycle.

Critical Impact
A low-privileged attacker on the network can retrieve uninitialized memory contents from Windows Networking components, potentially exposing credentials, kernel pointers, or other sensitive data usable in follow-on attacks.

Affected Products

Microsoft Windows 10 Version 1607 (x64)
Microsoft Windows Server 2016
Windows Networking component on the above platforms

Discovery Timeline

2024-09-10 - CVE-2024-43458 published to NVD and disclosed by Microsoft
2024-09-10 - Microsoft releases security patch via Security Update Guide
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43458

Vulnerability Analysis

The vulnerability resides in Windows Networking code paths that return data structures to network callers without fully initializing all fields. When the kernel or a networking service allocates a buffer and populates only part of it before returning the buffer over the network, residual bytes remain from prior allocations. Those residual bytes may contain kernel pointers, session data, or fragments of other users' memory.

An attacker requires network access and low-level privileges to reach the affected interface. No user interaction is required, and attack complexity is low. The scope change indicates the disclosed information originates from a security context different from the attacker's, which increases the value of the leaked data for chained exploitation.

Root Cause

The root cause is CWE-908: Use of Uninitialized Resource. A networking routine emits a response buffer whose padding or optional fields are not zeroed before transmission. This pattern typically arises when a structure is allocated with routines such as ExAllocatePool without a subsequent RtlZeroMemory call, or when conditional branches skip initialization of specific fields.

Attack Vector

Exploitation occurs over the network against a Windows Networking service on a vulnerable Windows 10 1607 or Windows Server 2016 host. The attacker authenticates with low privileges, then issues crafted networking requests that trigger the vulnerable response path. Returned responses include uninitialized memory that the attacker parses offline to extract sensitive artifacts. Repeated requests can be used to sample memory over time and reconstruct high-value secrets. See the Microsoft Security Update Guide entry for vendor-supplied technical details.

Detection Methods for CVE-2024-43458

Indicators of Compromise

Repeated authenticated network requests to Windows Networking services from a single low-privileged principal, particularly against unpatched Windows Server 2016 and Windows 10 1607 hosts.
Anomalous response sizes or unusual query patterns to SMB, RPC, or related networking endpoints on affected hosts.
Presence of hosts running Windows 10 1607 or Windows Server 2016 without the September 2024 cumulative update installed.

Detection Strategies

Correlate authentication logs (Event IDs 4624/4625) with subsequent high-volume networking activity from the same account against affected servers.
Baseline normal query volume to Windows Networking services and alert on statistically significant deviations from a single source.
Inventory endpoints and servers to identify systems running Windows 10 1607 or Windows Server 2016 missing the September 2024 patch (KB5042881 and related updates).

Monitoring Recommendations

Enable and forward Windows Security, System, and network telemetry to a centralized analytics platform for cross-host correlation.
Monitor east-west traffic to legacy Windows Server 2016 hosts and flag unusual authenticated network reconnaissance.
Track patch compliance for the September 2024 Windows update cycle across all affected SKUs and generate alerts on drift.

How to Mitigate CVE-2024-43458

Immediate Actions Required

Apply the September 2024 Microsoft security update for Windows 10 1607 and Windows Server 2016 as documented in the Microsoft Security Update Guide.
Inventory all Windows 10 1607 and Windows Server 2016 assets and prioritize patching internet-adjacent and identity-adjacent systems first.
Restrict network access to Windows Networking services using firewall rules and network segmentation until patches are deployed.
Enforce least privilege on service accounts to reduce the population of principals capable of reaching the vulnerable interface.

Patch Information

Microsoft released fixes on 10 September 2024 via the monthly security update cycle. Administrators should install the cumulative update corresponding to their Windows 10 1607 or Windows Server 2016 build. Refer to the Microsoft Security Update Guide for the specific KB article and download links for each affected SKU.

Workarounds

Block inbound access to Windows Networking services (SMB, RPC) from untrusted network segments using host and perimeter firewalls.
Require authenticated, segmented VPN access for any administrative connectivity to legacy Windows Server 2016 systems.
Retire or isolate end-of-support Windows 10 1607 endpoints where patching cannot be guaranteed on the required cadence.

bash

# Example: restrict inbound SMB to trusted management subnet on Windows Server 2016
New-NetFirewallRule -DisplayName "Restrict SMB to Mgmt Subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block SMB from Other Sources" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -Action Block

# Verify patch level
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2024-09-10") }