CVE-2024-28916

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.

According to the CVSS metrics, the attack vector is local (AV:L) and privilege required is low (PR:L). What does that mean for this vulnerability?

An attacker must have local access to the targeted machine and must be able to create folders and performance traces on the machine, with restricted privileges that normal users have by default.

How do I get the updated app?

The Microsoft Store will automatically update affected customers. Alternatively, customers can get the update immediately; see here for information about the apps installed on your device.

It is possible for customers to disable automatic updates for the Microsoft Store. The Microsoft Store will not automatically install this update for those customers.

If you want to get updates immediately, or if you don't have automatic updates enabled, select Get Updates. You can then update apps individually by selecting Update for each app, or you can select Update all to install all updates. We recommend that you select Update all as a best practice to stay protected.

Customers using the Microsoft Store for Business and Microsoft Store for Education can get this update through their organizations.

How can I check if the update is installed?

App package versions 19.87.13001.0 and later contain this update.

You can check the package version in PowerShell:

get-appxpackage Microsoft.GamingServices