Microsoft Windows Kernel-Mode Driver Privilege Escalation (CVE-2024-35250)

Historical catalog analysis: CISA added this entry on December 16, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-35250 is an untrusted pointer dereference vulnerability (CWE-822) located within the Microsoft Windows Kernel-Mode Driver. This flaw allows a local attacker—one who already has a foothold on the system—to escalate their privileges, potentially gaining higher-level administrative or kernel-level access.

Exposure and applicability

This vulnerability affects systems running the impacted version of the Microsoft Windows Kernel-Mode Driver. Because this is a local privilege escalation (LPE) flaw, the primary exposure path requires an attacker to have already established a presence on the target endpoint. It does not provide initial remote access but serves as a mechanism for an actor to move from a low-privileged user account to a more powerful security context.

Remediation priorities

Our analysis suggests that vulnerability management teams should prioritize remediation based on the criticality of the asset and the level of access granted to local users.

1. Apply Vendor Mitigations: The primary corrective action is to apply the mitigations provided by Microsoft. This should be prioritized for high-value targets where local access is common or shared.
2. Asset Decommissioning: In scenarios where vendor mitigations are unavailable or cannot be applied due to legacy constraints, our analysis suggests discontinuing use of the affected product to eliminate the exposure path.
3. Privilege Review: While not a direct fix for the kernel flaw, reducing the number of users with local access can limit the pool of potential attackers capable of triggering this vulnerability.

How to validate remediation

Verification must go beyond confirming that a patch was deployed; defenders must ensure the mitigation is active and effective in the runtime environment.

• Configuration Audit: Verify that the specific updates or configuration changes mandated by Microsoft are present across all targeted Windows assets.
• Deployment Confirmation: Use centralized management tools to confirm that the update has been successfully initialized and that no pending reboots are preventing the kernel-mode driver from updating.

It is important to note that a version check alone does not prove mitigation, as it does not account for failed installations or configuration overrides that may leave the system exposed.

Limits and open questions

There are several unknowns regarding this vulnerability. The source indicates that known use in ransomware campaigns is currently unknown. Additionally, while CISA has established a remediation deadline of January 6, 2025, for federal agencies, this date serves as a benchmark rather than a universal requirement for all organizations.

Residual risk remains if the system is patched but other local vulnerabilities exist that allow an attacker to reach the state necessary to trigger the pointer dereference. Furthermore, the effectiveness of any mitigation depends on the successful application of vendor-specific instructions.

Source and editorial note

CVE-2024-35250: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability · Source date: December 16, 2024 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 19, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 31, 2026 at 00:44 UTC.

Request a Vulnerability Assessment