OMENWAVE modelled vulnerability-chaining pathways

CVE-2024-30040

Windows MSHTML Platform Security Feature Bypass Vulnerability

8.8
CVSS High
3.9%
EPSS p90
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
INITIAL_ACCESS
Requires
NONE access, NETWORK vector, user interaction
Grants
USER access
Capabilities
code execution
Model confidence
high · CVSS 3.1
Top plausible next hops
CVE-2021-34527INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who s…

CVE-2017-0144INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Win…

CVE-2022-30190INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who succ…

CVE-2017-0143INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Win…

CVE-2020-1147INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source m…

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2024-30040