Patch Tuesday, June 2024 “Recall” Edition

Summary: Microsoft released updates fixing more than 50 security vulnerabilities in Windows and related software in its June 2024 Patch Tuesday, and said its new Recall feature on Copilot+ PCs would no longer be enabled by default after criticism that it constantly screenshots user activity. Only one patch, CVE-2024-30080, earned a critical rating: a Microsoft Message Queuing flaw with a CVSS score of 9.8 that allows attackers to execute code of their choosing, and Microsoft says exploitation is likely.
Bottom line: A 9.8-rated MSMQ flaw that Microsoft itself says is likely to be exploited sits on a few thousand potentially internet-facing servers, and the same release cycle shipped a screenshot feature that former Microsoft threat analyst Kevin Beaumont showed any non-administrator user could export from a local SQLite database.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-30078 CVE-2024-30080 CVE-2024-30101 CVE-2024-30104
Related: Only one critical issue disclosed as part of Microsoft Patch Tuesday Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026