CVE-2024-43532: Windows 10 Privilege Escalation Flaw

CVE-2024-43532 Overview

CVE-2024-43532 is an elevation of privilege vulnerability in the Windows Remote Registry Service. The flaw affects a broad range of Microsoft Windows desktop and server releases, including Windows 10, Windows 11, and Windows Server versions from 2008 through 2022. An authenticated attacker with low privileges on the network can exploit the weakness to gain higher privileges on the target system. Microsoft categorizes the issue under [CWE-636: Not Failing Securely ("Failing Open")]. The CVE was published to the National Vulnerability Database on October 8, 2024.

Critical Impact
Successful exploitation allows a low-privileged network attacker to elevate privileges, resulting in high impact to confidentiality, integrity, and availability of the affected Windows host.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43532 published to NVD and addressed in Microsoft's October 2024 security update
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-43532

Vulnerability Analysis

The Remote Registry Service (RemoteRegistry) allows authorized users to read and modify registry hives on remote Windows systems over the Remote Procedure Call (RPC) transport. CVE-2024-43532 arises from unsafe fallback behavior in the underlying WinReg RPC client. When a secure transport such as SMB or an RPC-over-named-pipes binding is unavailable, the client falls back to a less protected transport without preserving the security assurances of the original channel. This mishandling aligns with [CWE-636], where failure conditions do not default to a secure state.

An attacker positioned to relay the fallback authentication traffic can coerce a victim to authenticate to attacker-controlled infrastructure. The relayed credentials can then be forwarded to sensitive endpoints such as Active Directory Certificate Services, yielding certificates or session material that grant elevated access.

Root Cause

The root cause is insecure transport negotiation in the WinReg RPC client. When the preferred authenticated binding fails, the client proceeds with a downgraded binding rather than aborting the operation, exposing the NTLM authentication material to a Man-in-the-Middle actor.

Attack Vector

Exploitation is performed over the network by a low-privileged authenticated user. The attacker triggers or intercepts a WinReg client request, coerces the downgrade, and relays the resulting NTLM authentication to a target service to obtain elevated privileges.

No verified proof-of-concept code is referenced in the NVD advisory. Refer to the Microsoft CVE-2024-43532 Advisory for authoritative technical details.

Detection Methods for CVE-2024-43532

Indicators of Compromise

Unexpected NTLM authentication events from Windows hosts to non-standard destinations, particularly toward AD CS endpoints (certsrv, /certsrv/certfnsh.asp).
Outbound RPC traffic from the WinReg client that does not traverse the standard SMB named-pipe binding to \PIPE\winreg.
Anomalous invocations of RegConnectRegistry or winreg RPC calls against multiple internal hosts from a single low-privileged account.

Detection Strategies

Monitor Windows Security Event ID 4624 for NTLM logons where the authenticating channel or workstation name is inconsistent with the source host.
Alert on Event ID 4776 (NTLM credential validation) originating from services that normally use Kerberos.
Correlate Remote Registry Service starts (Event ID 7036 for the RemoteRegistry service) with unusual authentication sequences on the same host.

Monitoring Recommendations

Enable auditing of the Remote Registry Service and forward events to a centralized analytics platform for correlation across endpoints and identity providers.
Track NTLM relay indicators on AD CS servers by enabling IIS logging and reviewing certsrv request patterns.
Baseline legitimate WinReg RPC clients and flag any process that initiates registry RPC against multiple remote hosts within a short window.

How to Mitigate CVE-2024-43532

Immediate Actions Required

Apply the October 2024 Microsoft security updates that remediate CVE-2024-43532 across all affected Windows and Windows Server versions.
Inventory hosts running the RemoteRegistry service and prioritize patching on domain controllers, certificate authorities, and management servers.
Enforce Extended Protection for Authentication (EPA) and require SMB signing to reduce NTLM relay opportunities.

Patch Information

Microsoft published the fix in the October 2024 Patch Tuesday cycle. Details and per-build knowledge base articles are available in the Microsoft CVE-2024-43532 Advisory. Given the EPSS probability of 11.97% (95.77th percentile), operators should treat patching as time-sensitive.

Workarounds

Disable the Remote Registry Service on hosts that do not require remote registry administration by setting the RemoteRegistry service startup type to Disabled.
Restrict inbound RPC and SMB access to management subnets using host-based firewall rules and network segmentation.
Enable LDAP channel binding and LDAP signing on domain controllers to blunt downstream NTLM relay attacks.
Configure AD CS web enrollment endpoints to require HTTPS with EPA to prevent certificate issuance from relayed credentials.

bash

# Disable the Remote Registry Service where it is not required
sc.exe config RemoteRegistry start= disabled
sc.exe stop RemoteRegistry

# Enforce SMB signing on Windows clients and servers
Set-SmbClientConfiguration -RequireSecuritySignature $true -Confirm:$false
Set-SmbServerConfiguration -RequireSecuritySignature $true -Confirm:$false