Actively exploited · Published Sep 17, 2024 · Assigned by vmware
CVE-2024-38812Heap-overflow vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity heap buffer overflow in VMware Cloud Foundation. Attackers are actively exploiting it in the wild (listed by CISA on November 20, 2024). The chance it is exploited in the next 30 days is estimated at 54.6% (higher than 99.0% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 11, 2024.
Official description
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware vCenter Server | 8.0 – before 8.0 U3b7.0 – before 7.0 U3s |
| n/a | VMware Cloud Foundation | 5.x4.x |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H