CVE-2024-38257
Published: 10 September 2024
Summary
CVE-2024-38257 is a high-severity Use of Uninitialized Resource (CWE-908) vulnerability in Microsoft Windows 10 22H2. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 10.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-38257 is an information disclosure flaw in the Microsoft AllJoyn API, assigned a CVSS 3.1 score of 7.5 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and linked to CWE-908 for use of an uninitialized resource.
An unauthenticated attacker with network access can exploit the issue without user interaction to obtain sensitive information from affected systems.
Microsoft has published an advisory at msrc.microsoft.com detailing the vulnerability, while Talos Intelligence has released a report covering TALOS-2024-1980. The associated EPSS score remains low, with a recorded peak of 0.0542 that has since receded to the current value of 0.0433.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37222
Vulnerability details
Microsoft AllJoyn API Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.