CVE-2024-23440

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows to read up to 0x802 of memory from ar arbitrary user-supplied pointer.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
VirusBlokAda	Vba32 Antivirus	3.36.0

References

https://fluidattacks.com/advisories/adderley/Third Party Advisory
https://www.anti-virus.by/vba32Product
https://fluidattacks.com/advisories/adderley/Third Party Advisory
https://www.anti-virus.by/vba32Product

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-234415.5Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.CVE-2024-234426.1An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously CVE-2024-234434.9A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted CVE-2024-234447.5It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Cert CVE-2024-234456.5It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cl CVE-2024-234466.5An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level se CVE-2024-234476.5An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with expl CVE-2024-234487.5An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document fai CVE-2024-234495.3An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the R CVE-2024-23455.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fold CVE-2024-234507.5A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsea CVE-2024-234516.5Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elastic