CVE-2024-38140
Published: 13 August 2024
Summary
CVE-2024-38140 is a critical-severity Use After Free (CWE-416) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Reliable Multicast Transport Driver (RMCAST) contains a remote code execution vulnerability tracked as CVE-2024-38140. The flaw is a use-after-free condition (CWE-416) that affects the Windows kernel-mode RMCAST component and carries a CVSS 3.1 score of 9.8, reflecting network attackability, low complexity, and no required privileges or user interaction.
An unauthenticated attacker can send specially crafted multicast traffic over the network to trigger the flaw, resulting in arbitrary code execution with kernel-level privileges and full control over the affected system confidentiality, integrity, and availability.
Microsoft’s Security Response Center advisory and the associated Talos technical report describe the official remediation steps and patch availability. The EPSS score remains low, with a current value of 0.0504 and a peak of 0.0532, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37099
Vulnerability details
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.