CVE-2024-43599: Windows 10 1507 RCE Vulnerability

CVE-2024-43599 Overview

CVE-2024-43599 is a remote code execution vulnerability in the Microsoft Remote Desktop Client. The flaw stems from a use-after-free condition [CWE-416] in the Remote Desktop Protocol (RDP) client component shipped with supported versions of Windows 10, Windows 11, and Windows Server. An attacker who controls a malicious RDP server can execute arbitrary code on a client that connects to it. Exploitation requires user interaction: the victim must initiate or accept an RDP session with the attacker-controlled host. Successful exploitation grants attacker-level code execution in the context of the connecting user.

Critical Impact
An attacker hosting a malicious RDP server can achieve remote code execution on any Windows client that connects, with full impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43599 published to NVD as part of Microsoft's October 2024 Patch Tuesday
2024-10-17 - Last updated in NVD database

Technical Details for CVE-2024-43599

Vulnerability Analysis

The vulnerability resides in the Microsoft Remote Desktop Client, the component responsible for negotiating and rendering RDP sessions on Windows endpoints. NVD classifies the root weakness as a use-after-free [CWE-416], a memory safety defect in which code references heap memory after it has been released. When the client processes specific protocol messages or session data from a server, an object is freed while a dangling pointer to it remains reachable. Subsequent dereference of that pointer allows an attacker to corrupt memory and redirect execution.

The EPSS model places this issue in the 88th percentile for exploitation likelihood, reflecting the prevalence of RDP and the historical exploitability of client-side memory corruption in this component. No public proof of concept is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The defect is an object lifetime error inside the RDP client. A heap-allocated structure is released along one code path while another path retains and later dereferences the same pointer. An attacker who controls server-side data can shape the heap and time the free-then-use sequence to gain control of an indirect call or write primitive.

Attack Vector

The attack vector is network-based but client-initiated. An attacker stands up a malicious RDP server and lures a target to connect, for example through a phishing email containing an .rdp file, a malicious link using the rdp:// handler, or a compromised jump host that proxies traffic to the attacker. Once the client establishes the session, the server delivers crafted protocol data that triggers the use-after-free in the client process. Code executes with the privileges of the user running the Remote Desktop Client.

No authentication to the victim machine is required, but user interaction is mandatory because the victim must initiate the RDP connection.

Detection Methods for CVE-2024-43599

Indicators of Compromise

Outbound RDP connections (TCP/3389 or UDP/3389) from workstations to untrusted external hosts or recently registered domains.
mstsc.exe spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or other LOLBins.
.rdp file attachments delivered via email, downloaded from the web, or opened from removable media.
Crash dumps or Windows Error Reporting entries referencing mstscax.dll, mstsc.exe, or related RDP client modules.

Detection Strategies

Hunt for process creation events where the parent is mstsc.exe and the child is a scripting interpreter, shell, or signed binary commonly abused for execution.
Correlate RDP client launches against the destination IP reputation and historical baseline of approved RDP targets per user.
Alert on email gateway delivery of .rdp files and on browser-initiated rdp:// URI handler invocations.

Monitoring Recommendations

Enable command-line and module-load logging on endpoints and forward to a centralized analytics platform for retention and correlation.
Monitor egress firewall logs for outbound 3389/tcp connections to non-corporate destinations and treat them as high-priority review items.
Track Windows patch state across the fleet and flag systems missing the October 2024 cumulative update that addresses CVE-2024-43599.

How to Mitigate CVE-2024-43599

Immediate Actions Required

Deploy the October 2024 Microsoft security updates that remediate CVE-2024-43599 to every affected Windows 10, Windows 11, and Windows Server build in the environment.
Block outbound TCP/UDP 3389 at the perimeter except to explicitly approved destinations, removing the path to attacker-controlled RDP servers.
Disable or restrict the rdp:// URI handler and quarantine inbound .rdp email attachments at the mail gateway.
Prioritize patching of administrative workstations and jump hosts where RDP client usage is routine.

Patch Information

Microsoft released fixes for CVE-2024-43599 in the October 2024 monthly security update. Refer to the Microsoft Security Update Guide for CVE-2024-43599 for the specific KB articles and build numbers that apply to each affected Windows version.

Workarounds

Restrict outbound RDP to a curated allow-list of internal servers using host firewall rules or network ACLs.
Enforce least privilege so that users running mstsc.exe do not hold local administrator rights, limiting the impact of client-side code execution.
Use group policy to disable the rdp:// protocol handler on systems that do not require ad hoc outbound RDP.

bash

# Example: block outbound RDP from user workstations using Windows Defender Firewall
netsh advfirewall firewall add rule name="Block Outbound RDP" ^
    dir=out action=block protocol=TCP remoteport=3389 profile=any
netsh advfirewall firewall add rule name="Block Outbound RDP UDP" ^
    dir=out action=block protocol=UDP remoteport=3389 profile=any