Microsoft December Patch Tuesday 2024: 71 Vulnerabilities Addressed, Including Critical Zero-Day Flaws

Microsoft’s December 2024 Patch Tuesday addresses 71 new issues as part of a year that saw 1,009 CVEs patched; the bulletin highlights CVE-2024-49138 (a CLFS heap-based buffer overflow elevation-of-privilege zero-day actively exploited in the wild, CVSSv3 7.8), critical remote code execution flaws in SharePoint and MSMQ (CVSS up to 8.1), and notes that ransomware operators have increasingly leveraged CLFS vulnerabilities to escalate privileges and move laterally.