CVE-2024-38178

Deeper analysis

CVE-2024-38178 is a memory corruption vulnerability in the Scripting Engine, assigned CWE-843. It carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, high attack complexity, no required privileges, and required user interaction, with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can trigger the flaw by serving specially crafted content that a victim must interact with, resulting in arbitrary code execution within the scripting engine's context. The published EPSS score of 0.3023 indicates a moderate likelihood of exploitation in the wild.

Microsoft's advisory at msrc.microsoft.com and CISA's Known Exploited Vulnerabilities catalog both list the issue, confirming active exploitation and directing administrators to apply the vendor-supplied security updates. The unchanged peak and current EPSS values do not show a post-disclosure climb that would indicate rising attacker interest.