May 2024 [April showers bring May Privilege Escalation Vulns]

Episode 07   Published May 14, 2024 21 minute watch

Summary

May 2024 Patch Tuesday landed light at 61 fixes, weighted toward privilege escalation rather than remote code execution. That mix matters because most compromises now start with a phished user. Flaws like CVE-2024-30033 (Windows Search Service) and CVE-2024-30018 (Windows kernel) are the second link in an exploit chain that turns a single user into full system or server control. Mat Lee and Jason Kikta also flagged CVE-2024-4671, a known-exploited Chrome use-after-free that can chain into a sandbox escape, and macOS Sonoma 14.5 memory and code-signing fixes that signal Apple is drawing more research scrutiny.