CVE-2024-30072: 
vulnerability analysis and mitigation

Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability (CVE-2024-30072) was disclosed on June 11, 2024. This vulnerability affects multiple Windows systems including Windows 11 22H2, Windows 11 23H2, and Windows Server 2022 23H2 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) (NVD).

This vulnerability can be triggered by opening a malicious Microsoft Event Trace Log file. Given that IT teams commonly use Event Trace Log files for system debugging and often have high privileges, successful exploitation could provide attackers with substantial access to sensitive systems (Help Net Security).

The vulnerability requires local access and user interaction to be exploited. While there are no reports of this vulnerability being exploited in the wild, its nature makes it particularly concerning for IT support roles who regularly work with Event Trace Log files (Help Net Security).

Microsoft has released security updates to address this vulnerability. The fixes are available through KB5039212 for Windows 11 (22H2 and 23H2) and KB5039236 for Windows Server 2022 23H2 (Rapid7).