Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, 71 flaws

Today is Microsoft’s December 2024 Patch Tuesday, which includes security updates for 71 flaws, including one actively exploited zero-day vulnerability.

This Patch Tuesday fixed sixteen critical vulnerabilities, all of which are remote code execution flaws.

The number of bugs in each vulnerability category is listed below:

• 27 Elevation of Privilege Vulnerabilities
• 30 Remote Code Execution Vulnerabilities
• 7 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerabilities

This count does not include two Edge flaws that were previously fixed on December 5 and 6th.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5048667 & KB5048685 cumulative updates and the Windows 10 KB5048652 cumulative update.

One actively exploited zero-day disclosed

This month’s Patch Tuesday fixes one actively exploited, publicly disclosed zero-day vulnerability.

Microsoft classifies a zero-day flaw as one that is publicly disclosed or actively exploited while no official fix is available.

The actively exploited zero-day vulnerability in today’s updates are:

CVE-2024-49138 – Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft has fixed an actively exploited zero-day that allows attackers to gain SYSTEM privileges on Windows devices.

No information has been released as to how the flaw was exploited in attacks.

However, as it was discovered by the Advanced Research Team with CrowdStrike, we will likely see a report about its exploitation in the future.

GeekFeed contacted CrowdStrike for more information but has not yet received a response.

Recent updates from other companies

Other vendors who released updates or advisories in December 2024 include:

• Adobe released security updates for numerous products, including Photoshop, Commerce, Illustrator, InDesign, After Effects, Bridge, and more.
• CISA released advisories on industrial control system vulnerabilities in MOBATIME, Schneider Electric, National Instruments, Horner Automation, Rockwell Automation, and Ruijie.
• Cleo security file transfer is impacted by an actively exploited zero-day used in data theft attacks.
• Cisco releases security updates for multiple products, including Cisco NX-OS and Cisco ASA.
• IO-Data zero-day router flaws exploited in attacks to take over devices.
• 0patch released an unofficial patch for a Windows zero-day vulnerability that allows attackers to capture NTLM credentials.
• OpenWrt releases security updates for a Sysupgrade flaw that allowed attackers to distribute malicious firmware images.
• SAP releases security updates for multiple products as part of December Patch Day.
• Veeam released security updates for a critical RCE bug in Service Provider Console.

The December 2024 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the December 2024 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.