Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs (2024)

Update 4/9/24: Added information on two zero-day vulnerabilities that Microsoft did not initially mark as exploited.

Today is Microsoft's April 2024 Patch Tuesday, which includes security updates for 150 flaws and sixty-seven remote code execution bugs.

Only three critical vulnerabilities were fixed as part of today's Patch Tuesday, but there are over sixty-seven remote code execution bugs. More than half of the RCE flaws are found within Microsoft SQL drivers, likely sharing a common flaw.

There were also fixes for twenty-six Secure Boot bypasses released this month, including two from Lenovo.

The total count of 150 flaws does not include 5 Microsoft Edge flaws fixed on April 4th and 2 Mariner flaws. Mariner is anopen-source Linux distributiondeveloped by Microsoft for its Microsoft Azure services.

This month's Patch Tuesday fixed two zero-day vulnerabilities actively exploited in malware attacks.

Microsoft initially failed to mark the zero days as actively exploited, but Sophos and Trend Micro shared information on how they were actively exploited in attacks.

Below is a summary of the zero days, with more details provided in adedicated article.

Sophos shared that this CVE is assigned to a malicious driver signed with a valid Microsoft Hardware Publisher Certificate.

The driver was used to deploy a backdoor previously disclosed by Stairwell.

Team lead Christopher Budd told BleepingComputer that previous drivers reported to Microsoft that they did not receive a CVE, but rather an advisory was issued.

It is unclear why a CVE was released today for this driver, unless it was because a valid Microsoft Hardware Publisher Certificate signed it.

CVE-2024-29988 is a patch bypass for the CVE-2024-21412 flaw (also a patch bypass for CVE-2023-36025), which allows attachments to bypass Microsoft Defender Smartscreen prompts when the file is opened.

Microsoft has not assigned CVEs to the two flaws and they have been added to the patching backlog, with no timeline as to when they will be fixed.

Other vendors who released security updates or vulnerability advisories in April 2024include:

Below is the complete list of resolved vulnerabilities in the April 2024 Patch Tuesday updates.

To access the full description of each vulnerability and the systemsit affects, you can view the full report here.