CVE-2024-38178

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 5 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

30.23%

probability

This CVE has a 30.23% probability of being exploited in the next 30 days.

0% Top 96.8th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

7.5

HIGH

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

NVD

Scripting Engine Memory Corruption Vulnerability

Affected Products

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Attack Intelligence

CWE-664 · Improper Control of a Resource Through its Lifetime CWE-704 · Incorrect Type Conversion CWE-843 · Type Confusion

Google Project Zero

Patched

Aug. 13, 2024

Reported by

AhnLab and National Cyber Security Center(NCSC), Republic of Korea

Root Cause Analysis

???

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178

Patch Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38178

US Government Resource

Signal Intelligence

Confidenceⓘ

92%

EPSS 30.23%

CVSS v3.1 7.5

Mentions 5

Last Seen Oct 16, 2024

CNA Information

Analyst Note

This CVE is a confirmed zero-day in Windows 11 24H2 with a HIGH CVSS score (7.5) affecting the Scripting Engine. Its inclusion in Google Project Zero's research combined with reports of active exploitation in Microsoft's August 2024 Patch Tuesday provide strong evidence validating the confirmed status.