Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-38149: Microsoft Windows BranchCache can be crashed by malicious packets

CVE-2024-38149 · published 2 years ago

Summary

A weakness in Microsoft Windows BranchCache can allow hackers to crash the service, disrupting file sharing and caching. This could cause inconvenience for users and affect the performance of your network. To protect your system, apply the latest Windows updates.

What to do

Update microsoft windows_10_1507 to version 10.0.10240.20796 or later.
Update microsoft windows_10_1607 to version 10.0.14393.7428 or later.
Update microsoft windows_10_1809 to version 10.0.17763.6414 or later.
Update microsoft windows_10_21h2 to version 10.0.19044.5011 or later.
Update microsoft windows_10_22h2 to version 10.0.19045.5011 or later.
Update microsoft windows_11_21h2 to version 10.0.22000.3260 or later.
Update microsoft windows_11_22h2 to version 10.0.22621.4317 or later.
Update microsoft windows_11_23h2 to version 10.0.22631.4317 or later.
Update microsoft windows_11_24h2 to version 10.0.26100.2033 or later.
Update microsoft windows_server_2016 to version 10.0.14393.7428 or later.
Update microsoft windows_server_2019 to version 10.0.17763.6414 or later.
Update microsoft windows_server_2022 to version 10.0.20348.2762 or later.
Update microsoft windows_server_2022_23h2 to version 10.0.25398.1189 or later.
Update microsoft windows 10 version 1507 to version 10.0.10240.20796 or later.
Update microsoft windows 10 version 1607 to version 10.0.14393.7428 or later.
Update microsoft windows 10 version 1809 to version 10.0.17763.6414 or later.
Update microsoft windows 10 version 21h2 to version 10.0.19044.5011 or later.
Update microsoft windows 10 version 22h2 to version 10.0.19045.5011 or later.
Update microsoft windows 11 version 21h2 to version 10.0.22000.3260 or later.
Update microsoft windows 11 version 22h2 to version 10.0.22621.4317 or later.
Update microsoft windows 11 version 22h3 to version 10.0.22631.4317 or later.
Update microsoft windows 11 version 23h2 to version 10.0.22631.4317 or later.
Update microsoft windows 11 version 24h2 to version 10.0.26100.2033 or later.
Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.27366 or later.
Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.27366 or later.
Update microsoft windows server 2012 to version 6.2.9200.25118 or later.
Update microsoft windows server 2012 (server core installation) to version 6.2.9200.25118 or later.
Update microsoft windows server 2012 r2 to version 6.3.9600.22221 or later.
Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.22221 or later.
Update microsoft windows server 2016 to version 10.0.14393.7428 or later.
Update microsoft windows server 2016 (server core installation) to version 10.0.14393.7428 or later.
Update microsoft windows server 2019 to version 10.0.17763.6414 or later.
Update microsoft windows server 2019 (server core installation) to version 10.0.17763.6414 or later.
Update microsoft windows server 2022 to version 10.0.20348.2762 or later.
Update microsoft windows server 2022, 23h2 edition (server core installation) to version 10.0.25398.1189 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10_1507	< 10.0.10240.20796 `cpe:2.3:o:microsoft:windows_10_1507:::::::x64:*`
microsoft	windows_10_1607	< 10.0.14393.7428 `cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*`
microsoft	windows_10_1809	< 10.0.17763.6414 `cpe:2.3:o:microsoft:windows_10_1809::::::::`
microsoft	windows_10_21h2	< 10.0.19044.5011 `cpe:2.3:o:microsoft:windows_10_21h2::::::::`
microsoft	windows_10_22h2	< 10.0.19045.5011 `cpe:2.3:o:microsoft:windows_10_22h2::::::::`
microsoft	windows_11_21h2	< 10.0.22000.3260 `cpe:2.3:o:microsoft:windows_11_21h2::::::::`
microsoft	windows_11_22h2	< 10.0.22621.4317 `cpe:2.3:o:microsoft:windows_11_22h2::::::::`
microsoft	windows_11_23h2	< 10.0.22631.4317 `cpe:2.3:o:microsoft:windows_11_23h2::::::::`
microsoft	windows_11_24h2	< 10.0.26100.2033 `cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:*`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:r2::::::x64:`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-::::::x64:`
microsoft	windows_server_2016	< 10.0.14393.7428 `cpe:2.3:o:microsoft:windows_server_2016::::::::`
microsoft	windows_server_2019	< 10.0.17763.6414 `cpe:2.3:o:microsoft:windows_server_2019::::::::`
microsoft	windows_server_2022	< 10.0.20348.2762 `cpe:2.3:o:microsoft:windows_server_2022::::::::`
microsoft	windows_server_2022_23h2	< 10.0.25398.1189 `cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::`
microsoft	windows 10 version 1507	< 10.0.10240.20796
microsoft	windows 10 version 1607	< 10.0.14393.7428
microsoft	windows 10 version 1809	< 10.0.17763.6414
microsoft	windows 10 version 21h2	< 10.0.19044.5011
microsoft	windows 10 version 22h2	< 10.0.19045.5011
microsoft	windows 11 version 21h2	< 10.0.22000.3260
microsoft	windows 11 version 22h2	< 10.0.22621.4317
microsoft	windows 11 version 22h3	< 10.0.22631.4317
microsoft	windows 11 version 23h2	< 10.0.22631.4317
microsoft	windows 11 version 24h2	< 10.0.26100.2033
microsoft	windows server 2008 r2 service pack 1	< 6.1.7601.27366
microsoft	windows server 2008 r2 service pack 1 (server core installation)	< 6.1.7601.27366
microsoft	windows server 2012	< 6.2.9200.25118
microsoft	windows server 2012 (server core installation)	< 6.2.9200.25118
microsoft	windows server 2012 r2	< 6.3.9600.22221
microsoft	windows server 2012 r2 (server core installation)	< 6.3.9600.22221
microsoft	windows server 2016	< 10.0.14393.7428
microsoft	windows server 2016 (server core installation)	< 10.0.14393.7428
microsoft	windows server 2019	< 10.0.17763.6414
microsoft	windows server 2019 (server core installation)	< 10.0.17763.6414
microsoft	windows server 2022	< 10.0.20348.2762
microsoft	windows server 2022, 23h2 edition (server core installation)	< 10.0.25398.1189

Original advisory text

BranchCache Denial of Service Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38149 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published8 Oct 2024

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-38149 · NVD

CVE-2024-38149 · MITRE

Track software like this

Free during beta