Hacker News Reader

https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.ht... is very worthwhile reading as a write on up this - it's nothing inherent in IPv6 and was a bug in Windows's packet processing of reassembled packets.

I'm not convinced it would be particularly exploitable with a firewall between the system and the rest of the internet blocking unsolicited incoming traffic -which is what most consumer routers etc are doing for IPv6.

Better disable IPv4 then, as there were zero-click vulnerabilities in Windows in that as well, e.g., CVE-2021-24074.

If we stopped using things that had vulnerabilities, we'd be using sticks and stones by now.

Other operating systems weren't affected, so it's not inherent in the protocol itself.

Windows users with IPv6-blocking routers were protected from RCE.

Defense in depth is a viable approach if IPv6 features are not required.

Windows users with firewall-enabled routers were also protected from RCE.