CVE-2024-23615
Memory Safety in Broadcom Symantec Messaging Gateway ≤ 10.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23615 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Broadcom Symantec Messaging Gateway. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 21% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and earlier, specifically within the libdec2lha.so component. The flaw is tracked as CVE-2024-23615 with associated CWEs 119 and 120, and it received a CVSS 3.1 score of 10.0 reflecting network-accessible attack complexity that is low with no required privileges or user interaction.
An unauthenticated remote attacker can send specially crafted input to trigger the overflow, resulting in arbitrary code execution with root privileges on the messaging gateway.
Technical analysis published by Exodus Intel describes the stack-based overflow in detail and confirms the path to remote root code execution. The EPSS score has remained flat at 0.0630 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21109
Vulnerability Data
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can find missing size checks before deployment.
Input validation directly enforces size checks before buffer copies.
Secure engineering principles require memory-safe design and coding that structurally avoids buffer-boundary violations.
Memory protection restricts exploitation impact of buffer overflows without eliminating the underlying coding flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-119, a class-level weakness. Rules are authored against its narrower children: CWE-823.