CVE-2024-23440

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows to read up to 0x802 of memory from ar arbitrary user-supplied pointer.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-234415.5Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.CVE-2024-234426.1An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyCVE-2024-234434.9A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously craftedCVE-2024-234447.5It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new CertCVE-2024-234456.5It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-clCVE-2024-234466.5An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level seCVE-2024-234476.5An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explCVE-2024-234487.5An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document faiCVE-2024-234495.3An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the RCVE-2024-23455.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foldCVE-2024-234507.5A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the ElasticseaCVE-2024-234516.5Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elastic