{"id":"CVE-2024-38812","kind":"vulnerability","aliases":["CVE-2024-38812"],"related":[],"title":"The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol","description":"VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"VMware vCenter Server has a heap-based buffer overflow in its DCERPC protocol implementation. A remote attacker with network access can send a crafted packet to execute code on the vCenter Server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-11-20T00:00:00+00:00","products":[{"name":"VMware vCenter Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware cloud foundation","fixed":["5.2"],"affected":">= 4.0, < 5.2","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"vmware vcenter server","fixed":[],"affected":"= 8.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","on-prem","self-hosted","vcenter","vmware"],"not_affected_if":["managed-hosting","vcenter-not-deployed"],"how_to_check":"Check the vCenter Server version and build in the VAMI page or with the appliance shell; compare against the VMware advisory for CVE-2024-38812. unknown for exact affected versions.","fix":"Apply the vendor patch or mitigation from the VMware advisory for CVE-2024-38812; if no mitigation is available, discontinue use per CISA guidance. unknown for fixed version numbers.","status":"open","published_at":"2024-09-17T18:15:03+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:11+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:56:11Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor patch or mitigation from the VMware advisory for CVE-2024-38812; if no mitigation is available, discontinue use per CISA guidance. unknown for fixed version numbers.","reach":"network","impact":"high","summary":"VMware vCenter Server has a heap-based buffer overflow in its DCERPC protocol implementation. A remote attacker with network access can send a crafted packet to execute code on the vCenter Server.","category":"infrastructure","who_cares":["vmware","vcenter","self-hosted","on-prem"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the vCenter Server over the network.","analyst_note":"Exact affected and fixed versions and the vendor advisory link are not in the sources; confirm from the VMware security advisory for CVE-2024-38812.","how_to_check":"Check the vCenter Server version and build in the VAMI page or with the appliance shell; compare against the VMware advisory for CVE-2024-38812. unknown for exact affected versions.","needs_analyst":true,"not_affected_if":["managed-hosting","vcenter-not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000507,"input_tokens":2853,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':18A,21A '-38812':19A,22A 'access':65B,104C 'action':121C 'allow':99C 'appli':122C 'attack':62B,101C 'base':52B,85C 'buffer':53B,86C 'cisa':119C 'cloud':27A 'code':73B,112C 'contain':4A,81C 'could':98C 'craft':69B,117C 'cve':17A,20A 'dcerpc':15A,57B,94C 'discontinu':128C 'execut':72B,110C 'exploit':35B 'foundation':28A 'heap':7A,51B,84C 'heap-bas':50B,83C 'heap-overflow':6A 'host':42B 'implement':12A,59B,91C 'infrastructur':36B 'instruct':126C 'mitig':123C,134C 'network':64B,103C 'on-prem':37B 'overflow':8A,54B,87C 'packet':70B,118C 'per':124C 'prem':39B 'product':132C 'protocol':16A,58B,95C 'remot':61B,111C 'requir':120C 'self':41B 'self-host':40B 'send':67B,114C 'server':3A,25A,31A,34A,47B,77B,80C,108C 'special':116C 'unavail':136C 'use':129C 'vcenter':2A,24A,30A,33A,43B,46B,76B,79C,107C 'vendor':125C 'vmware':23A,26A,29A,32A,44B,45B,78C 'vulner':9A,88C,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-17T18:15:03+00:00","kev":{"dateAdded":"2024-11-20","dueDate":"2024-12-11","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-38812","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38812","severity":null,"published_at":"2024-11-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-38812","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38812","severity":null,"published_at":"2024-09-17T18:15:03+00:00","modified_at":"2026-06-17T07:41:05+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}