CVE-2024-43590: Visual C++ Redistributable Installer Elevation of Privilege Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-08 · updated 2026-08-19
Weakness: CWE-284

Description

Visual C++ Redistributable Installer Elevation of Privilege Vulnerability

Affected products

Microsoft Visual C++ Redistributable: from 10.0.0 before 14.40.33816 — fixed in 14.40.33816
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): from 15.0 before 15.9.67 — fixed in 15.9.67
Microsoft Visual Studio 2019: from 15.0 before 15.9.67; from 16.0 before 16.11.41 — fixed in 15.9.67, 16.11.41
Microsoft Visual Studio 2022 version 17.14: from 17.6.0 before 17.6.20; from 17.8.0 before 17.8.15; from 17.10.0 before 17.10.8; from 17.11.0 before 17.11.5 — fixed in 17.10.8, 17.11.5, 17.6.20, 17.8.15
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10): from 16.11.0 before 16.11.41 — fixed in 16.11.41
Microsoft Visual Studio 2022 version 17.10: from 17.10 before 17.10.8 — fixed in 17.10.8
Microsoft Visual Studio 2022 version 17.11: from 17.11 before 17.11.5 — fixed in 17.11.5
Microsoft Visual Studio 2022 version 17.6: from 17.6.0 before 17.6.20 — fixed in 17.6.20
Microsoft Visual Studio 2022 version 17.8: from 17.8.0 before 17.8.15 — fixed in 17.8.15
Microsoft Visual C++ Redistributable Installer: from 10.0.0 before 14.40.33816 — fixed in 14.40.33816
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): from 15.9.0 before 15.9.67 — fixed in 15.9.67

How to fix

Upgrade to a fixed version: Microsoft Visual C++ Redistributable 14.40.33816; Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.67; Microsoft Visual Studio 2019 15.9.67, 16.11.41; Microsoft Visual Studio 2022 version 17.14 17.10.8, 17.11.5, 17.6.20, 17.8.15; Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.41; Microsoft Visual Studio 2022 version 17.10 17.10.8; Microsoft Visual Studio 2022 version 17.11 17.11.5; Microsoft Visual Studio 2022 version 17.6 17.6.20; Microsoft Visual Studio 2022 version 17.8 17.8.15; Microsoft Visual C++ Redistributable Installer 14.40.33816; Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.67. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43590

Get alerted when CVE-2024-43590 or the next vulnerability affects your stack