CVE-2024-38178

HIGH CISA KEV EPSS 98.4%
Published Aug 13, 20241y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 13, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Aug 13, 2024 1y ago
KEV Due Sep 3, 2024 668d overdue

Description

Scripting Engine Memory Corruption Vulnerability

CVSS Details

Base Score
7.5
Exploitability
1.6
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 668d
Added
Aug 13, 2024
Due
Sep 3, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
98.4% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-843

Affected Products 14

VendorProductVersionRange
microsoftwindows_10_1507* <10.0.10240.20751
microsoftwindows_10_1607* <10.0.14393.7259
microsoftwindows_10_1809* <10.0.17763.6189
microsoftwindows_10_21h2* <10.0.19044.4780
microsoftwindows_10_22h2* <10.0.19045.4780
microsoftwindows_11_21h2* <10.0.22000.3147
microsoftwindows_11_22h2* <10.0.22621.4037
microsoftwindows_11_23h2* <10.0.22631.4037
microsoftwindows_11_24h2* <10.0.26100.1457
microsoftwindows_server_2012r2any
microsoftwindows_server_2016* <10.0.14393.7259
microsoftwindows_server_2019* <10.0.17763.6189
microsoftwindows_server_2022* <10.0.20348.2655
microsoftwindows_server_2022_23h2* <10.0.25398.1085

References 2

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178
    PatchVendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38178
    US Government Resource

Remediation

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178
    PatchVendor Advisory