Malware Exploitation and Vulnerability Assessment of CVE-2024-38063 in Windows 10 and 11 in Academic Networks Cybersecurity

This research investigates the vulnerability CVE-2024-38063 in Windows 10 and Windows 11 through detailed experimentation and risk assessment, focusing specifically on the cybersecurity implications for academic network environments. Using a controlled laboratory setup, the study systematically recreated and modified a Proof of Concept (PoC) exploit targeting vulnerabilities in IPv6 fragmentation and HTTP application layers. The testing involved iterative deployments of fragmentation attacks-including overlapping fragments, offset overflow, and reassembly queue flooding-and HTTP service fuzzing, employing tools such as Wireshark and Boofuzz. While direct system compromise was not achieved, the experiments identified significant operational stress, evident from critical CPU usage spikes and poor input validation leading to internal server errors. Additionally, the passive handling of malformed IPv6 packets without explicit logging created critical visibility gaps, indicating potential vulnerabilities for stealthy denial-of-service (DoS) attacks. A structured risk assessment based on the NIST Cybersecurity Framework (CSF) and NIST SP 800–53 revealed residual risks even in patched systems, particularly where monitoring and defense mechanisms were inadequate. This study underscores the critical importance of comprehen-sive cybersecurity measures, including continuous vulnerability testing, advanced intrusion detection capabilities, rigorous input validation, and proactive network defense strategies, to effectively mitigate emerging threats in academic settings.