CVE-2024-40432

CVE-2024-40432 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_COMMAND control of the SD card reader driver allows a privileged attacker to crash the OS.

Frequently asked questions

What is CVE-2024-40432?
A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_COMMAND control of the SD card reader driver allows a privileged attacker to crash the OS.
How severe is CVE-2024-40432?
CVE-2024-40432 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-40432 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-40432?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-40432 have an EU (EUVD) identifier?
Yes. CVE-2024-40432 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-38455.
When was CVE-2024-40432 published?
CVE-2024-40432 was published on 2024-10-23 and last updated on 2026-06-17.

References