Windows NT OS Kernel Integer Overflow — Local EoP From Low-Privilege User to SYSTEM (CVE-2024-43623)

An attacker who has already obtained any code execution on the host — through a phishing payload, a service exploit, or a malicious RDP user — can use this bug to escalate to SYSTEM. From SYSTEM, the attacker can dump LSASS to extract credentials, disable EDR drivers, install kernel rootkits, and persist indefinitely. Local kernel EoPs like this are the standard "second stage" in modern intrusion chains and are routinely bundled into off-the-shelf post-exploitation frameworks.

An integer overflow in the Windows NT kernel allows a process running as a low-privilege user to corrupt kernel memory and escalate to SYSTEM. Affected: Windows 10/11 and Windows Server 2008 SP2 through Windows Server 2025 prior to the November 2024 Patch Tuesday. The Microsoft advisory rates the vulnerability "Exploitation More Likely" — meaning Microsoft expects reliable exploit code to emerge and be incorporated into commodity attack tooling within roughly 30 days.

Probably yes if any of these apply:

CVE-2024-43623 was patched in the November 2024 Patch Tuesday rollup. Microsoft's "Exploitation More Likely" rating is reserved for bugs with simple, reliable exploit primitives — integer overflows in the kernel typically meet that bar because the path from overflow to controlled write is well-understood. Multiple researchers published kernel-crash PoCs shortly after disclosure; weaponised versions are expected to surface in red-team toolkits.