{"id":"CVE-2024-21351","published":"2024-02-13T18:15:51Z","modified":"2026-08-10T16:18:42Z","title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows SmartScreen Security Feature Bypass Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a security feature bypass in Microsoft Windows SmartScreen, the component that checks downloaded and untrusted content. An attacker can exploit it remotely over the network with no privileges or authentication, but the attack requires a user to interact with a crafted item, and it stems from improper control over code generation (code injection).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:24Z"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.27798,"percentile":0.98093,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2024-02-13","dueDate":"2024-03-05","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351; https://nvd.nist.gov/vuln/detail/CVE-2024-21351","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-13","exploitedFirstSeen":"2024-02-13","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Feb","date":"2024-02-13"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","date":"2024-02-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-13"},{"url":"https://ti.qianxin.com/uploads/2024/08/19/2274f632f6a1d8acd2f1801c24887edb.pdf","date":"2024-08-19"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"},{"url":"https://www.cert.europa.eu/publications/threat-intelligence/tlr2024/pdf","date":"2025-02-25"},{"url":"https://www.uscg.mil/Portals/0/Images/cyber/CGCYBER%202024%20CTIME.pdf","date":"2025-05-19"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21351","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21351","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: requires user to open malicious file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass Vulnerability","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-impairment"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: bypasses Mark-of-the-Web protection","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass","start":0,"end":43}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19063","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19063","exploited":true,"exploitedSince":"2024-02-13","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1553.005"],"provenance":"ai"}],"timeline":[{"date":"2024-02-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21351","provenance":"source"},{"date":"2024-02-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Feb","provenance":"source"},{"date":"2024-02-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19063","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":59.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 992 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9809"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.32,"detail":"base score 7.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-94"}}