CVE-2024-38145
Published: 13 August 2024
Summary
CVE-2024-38145 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-38145 is a denial of service issue in the Windows Layer-2 Bridge Network Driver, carrying a CVSS 3.1 base score of 7.5 and linked to CWE-476. It was published on 2024-08-13 and permits remote triggering of a crash or service interruption without requiring authentication or user interaction.
An unauthenticated attacker with network access can send crafted traffic that leads to high availability impact on affected systems while leaving confidentiality and integrity untouched. The EPSS score has remained flat at a peak of 0.1731 since disclosure, indicating no material rise in observed exploitation interest.
Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38145 addresses the flaw and supplies the corresponding security update for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37118
Vulnerability details
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.