CVE-2024-38638

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory.

QTS 5.2.x/QuTS hero h5.2.x are not affected.

We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QuTS hero h5.1.9.2954 build 20241120 and later

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-386394.8An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to comCVE-2024-38648.1Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we preCVE-2024-386405.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authentCVE-2024-386417.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-386427.8An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local netwCVE-2024-386439.8A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability coCVE-2024-386448.8An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenCVE-2024-386456.5A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow CVE-2024-386466.0An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerCVE-2024-386477.5An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remCVE-2024-386485.7A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uCVE-2024-386497.5An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at
CVE-2024-38638: High severity, CVSS 7.2 | Vulnix