CySec
en
  1. Home
  2. Blog
  3. Vulnerabilities & CVE

Windows TCP/IP IPv6 (CVE-2024-38063): zero-click remote code execution

Specially crafted IPv6 packets could run code on any Windows machine with IPv6 enabled — no login, no user action. Patch first; disabling IPv6 was only a fallback.

3 min read

Publicly disclosed: 13 August 2024

In the August 2024 Patch Tuesday Microsoft fixed a flaw in the Windows TCP/IP stack (tcpip.sys). By sending specially crafted IPv6 packets, an unauthenticated attacker could potentially execute code on the target. IPv6 is enabled by default on all modern Windows versions, and the firewall does not block the attack because the packets are processed before it.

CVESeverityAffectedFixed in
CVE-2024-38063Critical, CVSS 9.8 (remote code execution)All supported Windows and Windows Server versions with IPv6August 2024 security updates

How to protect

  1. Install the updates — this is the real fix.
  2. Microsoft listed disabling IPv6 as a mitigation for systems that cannot be patched, but IPv6 is used by some Windows components; test before turning it off.
  3. Filter IPv6 at network boundaries where it is not used.

Zero-click network flaws leave no time for users to make mistakes — only patching protects.

Good Windows patching habits

  • Install Patch Tuesday updates (second Tuesday of every month) within days for internet-facing systems and within two weeks for the rest.
  • Watch for out-of-band updates — Microsoft releases them only for serious issues.
  • Replace Windows versions that no longer receive security updates.

Sources: Microsoft CVE-2024-38063, NVD CVE-2024-38063.

Need help with this? Contact CySec for a free consultation.

Tags:#Windows

All articles

More on this topic

All articles in this topic
12 November 2026· 3 min read

N-able N-central “4EverAble2Shell” zero-day: when the remote management server is the target

A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.

Read article
10 November 2026· 4 min read

Outlook zero-day CVE-2026-124194 and November 2026 Patch Tuesday: what to update first

An exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.

Read article
9 November 2026· 3 min read

Chrome zero-day CVE-2026-125350: update the browser and restart it

Google fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.

Read article

Need help with this?

Our engineers can review your current setup and propose concrete improvements.

Request a quote
WhatsApp+374 33 870717 Emailinfo@cysec.am