Microsoft Monthly Security Update (December 2024)

Microsoft has released monthly security update for their products:

Vulnerable Product	Risk Level	Impacts	Notes
System Center	Medium Risk	Elevation of Privilege Spoofing
Microsoft Office	Medium Risk	Elevation of Privilege Information Disclosure Remote Code Execution
Windows	High Risk	Elevation of Privilege Remote Code Execution Information Disclosure Denial of Service	CVE-2024-49138 is being exploited in the wild. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Extended Security Updates (ESU)	High Risk	Elevation of Privilege Remote Code Execution Denial of Service Information Disclosure	CVE-2024-49138 is being exploited in the wild. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Developer Tools	Medium Risk	Remote Code Execution

Number of ‘Extremely High Risk’ product(s): 0

Number of ‘High Risk’ product(s): 2

Number of ‘Medium Risk’ product(s): 3

Number of ‘Low Risk’ product(s): 0

Evaluation of overall ‘Risk Level’: High Risk

Impact

• Elevation of Privilege
• Spoofing
• Information Disclosure
• Remote Code Execution
• Denial of Service

System / Technologies affected

• System Center
• Microsoft Office
• Windows
• Extended Security Updates (ESU)
• Developer Tools

Solutions

Before installation of the software, please visit the vendor web-site for more details.

•  Apply fixes issued by the vendor.

Vulnerability Identifier

• https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&year=2024&month=12

Source

• Microsoft

Related Link

• https://msrc.microsoft.com/update-guide/releaseNote/2024-Dec