CVE-2024-26174: 
vulnerability analysis and mitigation

Windows Kernel Information Disclosure Vulnerability (CVE-2024-26174) is a security flaw affecting multiple versions of Microsoft Windows operating systems. The vulnerability was initially disclosed on March 12, 2024, and received its latest update on December 27, 2024. The affected systems include various versions of Windows 10, Windows 11, and Windows Server (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Microsoft has classified this as an out-of-bounds read vulnerability (CWE-125). The attack requires local access with low complexity and privileges, with no user interaction needed (NVD).

This vulnerability could allow an attacker to obtain sensitive information from the Windows Kernel. The impact is primarily focused on confidentiality (rated as High), while there are no direct impacts on integrity or availability of the system (NVD).

The vulnerability requires local access to exploit, suggesting that an attacker would need prior access to the target system. The low complexity and privilege requirements indicate that once local access is obtained, the vulnerability is relatively straightforward to exploit (NVD).

Microsoft has released security updates to address this vulnerability across affected versions of Windows. Updates are available for Windows 10 (versions 1507 through 22H2), Windows 11 (versions 21H2 through 23H2), and various Windows Server versions including 2012, 2016, 2019, and 2022 (Rapid7).