CVE-2024-38199

Меры по смягчению последствий

The following mitigating factors might be helpful in your situation:

• Users are advised against installing or enabling the Line Printer Daemon (LPD) service.
• The LPD is not installed or enabled on the systems by default.
• The LPD has been announced as deprecated since Windows Server 2012. Please refer to: Features Removed or Deprecated in Windows Server 2012.

FAQ

How could an attacker exploit this vulnerability?

An unauthenticated attacker could send a specially crafted print task to a shared vulnerable Windows Line Printer Daemon (LPD) service across a network. Successful exploitation could result in remote code execution on the server.

Windows 11, version 24H2 is not generally available yet. Why are there updates for this version of Windows listed in the Security Updates table?

The new Copilot+ devices that are now publicly available come with Windows 11, version 24H2 installed. Customers with these devices need to know about any vulnerabilities that affect their machine and to install the updates if they are not receiving automatic updates. Note that the general availability date for Windows 11, version 24H2 is scheduled for later this year.