Live › vulnerability › CVE-2024-38812
Go to dashboardVMware vCenter Server has a heap-based buffer overflow in its DCERPC protocol implementation. A remote attacker with network access can send a crafted packet to execute code on the vCenter Server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware vCenter Server | vendor | – | – |
| vmware cloud foundation | vendor | >= 4.0, < 5.2 | 5.2 |
| vmware vcenter server | vendor | = 7.0 | – |
| vmware vcenter server | vendor | = 8.0 | – |
Check the vCenter Server version and build in the VAMI page or with the appliance shell; compare against the VMware advisory for CVE-2024-38812. unknown for exact affected versions.
Apply the vendor patch or mitigation from the VMware advisory for CVE-2024-38812; if no mitigation is available, discontinue use per CISA guidance. unknown for fixed version numbers.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-38812")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.