CVE-2024-21411: 
Homebrew vulnerability analysis and mitigation

Skype for Consumer Remote Code Execution Vulnerability (CVE-2024-21411) was discovered and disclosed on March 12, 2024. This vulnerability affects Skype installations up to version 8.113 and requires user interaction for exploitation (NVD, ZDI).

The vulnerability exists within the implementation of the Today tab in Skype, stemming from a lack of context isolation. It has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-453 (Insecure Default Variable Initialization) (ZDI, NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process, potentially leading to high impacts on confidentiality, integrity, and availability of the affected system (ZDI).

The vulnerability requires user interaction for exploitation, specifically requiring the target to visit a malicious page or open a malicious file. The attack vector is network-based with low attack complexity and requires no privileges for exploitation (ZDI).

Microsoft has issued an update to address this vulnerability. Users should update their Skype for Consumer installations to version 8.113 or later (ZDI).