What’s Vulnerable › Vulnerabilities

CVE-2024-38812: Heap-overflow vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-11-20
• EPSS: 54.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-17 · updated 2026-06-17
• Weakness: CWE-122

Description

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Summary

CVE-2024-38812 is a critical heap-based buffer overflow in VMware vCenter Server's DCERPC protocol implementation. A remote attacker with network access can send a crafted packet to potentially achieve remote code execution. The flaw affects VMware vCenter Server and VMware Cloud Foundation (fixed in 5.2). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 54.6% chance of exploitation in 30 days. Apply mitigations per vendor instructions or discontinue use if unavailable; upgrade to the fixed version where specified.

CVE-2024-38812 هو ثغرة تجاوز سعة المخزن المؤقت المستند إلى الكومة (heap-based buffer overflow) خطيرة في تنفيذ بروتوكول DCERPC في VMware vCenter Server. يمكن لمهاجم لديه وصول إلى الشبكة إرسال حزمة مُعدّة خصيصًا لاستغلال الثغرة، مما قد يؤدي إلى تنفيذ تعليمات برمجية عن بُعد. تؤثر الثغرة في VMware vCenter Server وVMware Cloud Foundation (تم إصلاحها في 5.2). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يومًا بنسبة 54.6%. طبّق التخفيفات وفقًا لتعليمات المورد أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات، وقم بالترقية إلى الإصدار المُصلح حيثما تم تحديده.

Affected products

• VMware Cloud Foundation: from 4.0 before 5.2 — fixed in 5.2
• VMware vCenter Server: 7.0, 7.0-a, 7.0-b, 7.0-c, 7.0-d, 7.0-update1 (+42)
• Broadcom Vmware Cloud Foundation: from 4.0 before 5.0; from 5.0 before 6.0 — fixed in 5.0, 6.0
• Broadcom Vmware Vcenter Server: from 8.00 before 8.0u3b; from 7.0 before 7.0u3s — fixed in 8.0u3b, 7.0u3s
• VMware Cloud Foundation: 5.x, 4.x
• VMware vCenter Server: from 8.0 before 8.0 U3b; from 7.0 before 7.0 U3s — fixed in 8.0 U3b, 7.0 U3s

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 5.2; Broadcom Vmware Cloud Foundation 5.0, 6.0; Broadcom Vmware Vcenter Server 8.0u3b, 7.0u3s; VMware vCenter Server 8.0 U3b, 7.0 U3s. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812

Get alerted when CVE-2024-38812 or the next vulnerability affects your stack