CVE-2024-23440

HIGH

Vba32 Antivirus 3.36.0 - Arbitrary Memory Read via Vba32m64.sys IOCTL 0x22200B

Title source: llm

Description

Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows to read up to 0x802 of memory from ar arbitrary user-supplied pointer.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/adderley/

Product product

https://www.anti-virus.by/vba32

Scores

CVSS v3 7.1

EPSS 0.0021

EPSS Percentile 11.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (1)

anti-virus/vba32 3.36.0

Published Feb 13, 2024

Tracked Since Feb 18, 2026