Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities

Cisco Talos summarizes Microsoft’s December 2024 Patch Tuesday: 72 vulnerabilities disclosed (four flagged as "critical" including CVE-2024-49112 with CVSS 9.8), many of which are remote code execution issues that Microsoft judges "less likely" to be exploitable due to high attack complexity (race conditions); CVE-2024-49138 is an elevation-of-privilege vulnerability reported as actively exploited. Talos also highlights several "important" but more-likely-to-be-exploited issues, and is releasing Snort/Snort3 rules (listed) to detect exploitation attempts.