Exploit for CVE-2024-21338

kitploit · 2026-08-29

Description

Local privilege escalation from admin to kernel in Windows 10/11 with HVCI via token manipulation.

Entry point

ParameterIOCTL_CODE · path

Path\\.\VulnerableDriver

IOCTL-based exploitation via a vulnerable Windows kernel driver device interface to escalate privileges

Affected software

Microsoft Windows 10 1809< 10.0.17763.5458

Microsoft Windows 10 21h2< 10.0.19044.4046

Microsoft Windows 10 22h2< 10.0.19045.4046

Microsoft Windows 11 21h2< 10.0.22000.2777

All known vulnerabilities by product

Windows Windows 10 Windows 11 Windows Applocker Windows Defender Windows Kernel Windows Server 2019 Windows Server 2022

CVSS 7.8 for CVE-2024-21338

7.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-08-29 20:50

Last Seen:2026-08-29 23:56

Reporter:KitPloit

Tags

Windows 10/11Local Privilege EscalationHVCIToken ManipulationKernel Exploitation

Other exploits for CVE-2024-21338

CVE-2024-21338_PoC

2026-08-30 KitPloitKITPLOIT

CVE-2024-21338-x64-build-

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

CVE-2024-21338-Exploit

2026-08-28 KitPloitKITPLOIT

CVE-2024-21338-1

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

Exploit Code

MARKDOWN14 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HAKAIOFFSEC-CVE-2024-21338
# CVE-2024-21338

Уязвимость локального повышения привилегий от администратора до ядра в операционных системах Windows 10 и Windows 11 с включённым HVCI.

## Компиляция

  * Используйте Microsoft Visual Studio с пакетом C++ для успешной компиляции PoC в режимах `Release` и `Debug`.



## Пост

Оригинальная публикация в блоге: https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/