Microsoft identified a use-after-free vulnerability (CWE-416) in the Servicing Stack of Windows 10 Version 1507 (build 10240.0), specifically impacting the Enterprise 2015 LTSB and IoT Enterprise 2015 LTSB editions. The issue arose because recent updates, including KB5035858 released March 12, 2024, rolled back previous fixes for vulnerabilities in Optional Components, effectively re-exposing these flaws. This vulnerability has a CVSS 3.1 score of 9.8 (critical) with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. Microsoft’s advisory states that the vulnerability is addressed by applying the September 2024 Servicing Stack Update (KB5043936) followed by the September 2024 security update (KB5043083). Other Windows 10 versions are not affected. The vulnerability is officially fixed and no known exploits are reported in the wild.

An attacker could exploit this use-after-free vulnerability to execute arbitrary code remotely without requiring privileges or user interaction, potentially leading to full system compromise including complete confidentiality, integrity, and availability loss on affected Windows 10 Version 1507 systems. The vulnerability affects only the Enterprise 2015 LTSB and IoT Enterprise 2015 LTSB editions with specific updates installed. Other Windows 10 versions are not impacted.

Microsoft has released an official fix for this vulnerability. To remediate, install the September 2024 Servicing Stack Update (KB5043936) first, followed by the September 2024 Windows security update (KB5043083). Systems running Windows 10 Version 1507 Enterprise 2015 LTSB and IoT Enterprise 2015 LTSB editions should apply these updates promptly. No other mitigation is required as the vulnerability is addressed by these official patches.