CVE-2024-43562 Overview
CVE-2024-43562 is a denial of service vulnerability in the Windows Network Address Translation (NAT) component. Microsoft disclosed the flaw on October 8, 2024 as part of its monthly security update cycle. An unauthenticated attacker can send specially crafted network traffic to a vulnerable Windows host to disrupt NAT processing and cause a service outage. The vulnerability affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2016 through 2022. The associated weakness is classified as [CWE-125] Out-of-Bounds Read.
Critical Impact
A remote, unauthenticated attacker can trigger a denial of service condition on any Windows host running the NAT service, disrupting connectivity for downstream clients.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-10-08 - CVE-2024-43562 published to NVD
- 2024-10-08 - Microsoft releases security patch through the October 2024 Patch Tuesday cycle
- 2024-10-17 - Last updated in NVD database
Technical Details for CVE-2024-43562
Vulnerability Analysis
The vulnerability resides in the Windows Network Address Translation (NAT) service, which translates IP addresses and ports between internal and external network segments. The flaw is rooted in an out-of-bounds read condition tracked as [CWE-125]. When the NAT component processes specially crafted packets, it reads memory beyond the bounds of the intended buffer. This unexpected read triggers a fault that disrupts the NAT service and degrades or halts network translation. The issue is reachable across the network without authentication or user interaction, broadening its exposure on hosts that perform NAT functions such as Internet Connection Sharing, Hyper-V virtual networking, and Windows Server routing roles.
Root Cause
The root cause is improper validation of packet field boundaries within the NAT packet handler. The component dereferences offsets derived from attacker-controlled header values without verifying that the offsets remain inside the allocated buffer. The resulting out-of-bounds read causes process state corruption sufficient to terminate or stall the NAT service.
Attack Vector
Exploitation requires only network access to a Windows host with the NAT role enabled. An attacker sends a crafted packet sequence targeting the NAT listener. No credentials, prerequisites, or user interaction are required. The impact is limited to availability — the flaw does not enable code execution or information disclosure, but it disrupts network services that depend on translation. The EPSS score is 2.188% with a percentile of 80.028, indicating elevated probability of exploitation activity relative to most CVEs. No public proof-of-concept exploit has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the Microsoft Security Update Advisory for the official technical description and patch references.
Detection Methods for CVE-2024-43562
Indicators of Compromise
- Repeated, unexplained restarts or crashes of the Windows NAT driver or SharedAccess service on hosts performing NAT roles.
- Sudden loss of outbound connectivity for clients behind a Windows NAT host without configuration changes.
- Malformed or truncated IP/UDP/TCP packets directed at the external interface of NAT-enabled Windows systems.
Detection Strategies
- Monitor the Windows Event Log for service control manager events indicating NAT-related service termination or recovery actions.
- Inspect network telemetry for anomalous packet patterns directed at hosts with NAT roles, including malformed headers or unusual fragmentation.
- Correlate connectivity loss events on internal clients with packet bursts observed at the NAT host boundary.
Monitoring Recommendations
- Enable verbose logging for the Routing and Remote Access Service (RRAS) and Internet Connection Sharing components.
- Alert on repeated crashes of ipnat.sys or related NAT kernel components captured by Windows Error Reporting.
- Track patch compliance for the October 2024 cumulative update across all Windows client and server endpoints.
How to Mitigate CVE-2024-43562
Immediate Actions Required
- Apply the October 2024 Microsoft security update to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on hosts exposed to untrusted networks that perform NAT, Internet Connection Sharing, or Hyper-V virtual switch NAT functions.
- Inventory systems with the RRAS role or SharedAccess service enabled and confirm patch installation status.
Patch Information
Microsoft published fixes for CVE-2024-43562 in the October 8, 2024 cumulative security updates. Refer to the Microsoft Security Update Advisory for the specific KB numbers corresponding to each affected Windows build.
Workarounds
- Disable the NAT role on hosts that do not require address translation, including stopping the SharedAccess service where not needed.
- Restrict inbound network access to NAT-enabled interfaces using host firewall rules or upstream network ACLs.
- Segment NAT-enabled Windows hosts away from untrusted networks until patching completes.
# Example: disable Internet Connection Sharing where not required
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess
# Example: restrict inbound traffic to the external interface
New-NetFirewallRule -DisplayName "Block-NAT-External" -Direction Inbound -InterfaceAlias "Ethernet" -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
