CVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Description
CVE-2024-37079 is a critical heap-overflow vulnerability in the DCERPC protocol implementation of VMware vCenter Server. A malicious actor with network access to vCenter Server can exploit this vulnerability by sending a specially crafted network packet, potentially achieving remote code execution. Rated CVSS v3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability requires no authentication, no user interaction, and has low attack complexity. Affected products include VMware vCenter Server versions 7.0 and 8.0, as well as VMware Cloud Foundation versions 4.0 through 5.2. The vulnerability is listed in CISA's KEV catalog with a remediation deadline of February 13, 2026, and carries an extremely high EPSS score of 0.82964 (99.2nd percentile), placing it among the most likely to be exploited vulnerabilities currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 4.0, < 5.2 |
| vmware | vcenter server | 8.0; 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2024-37079 is classified under CWE-787, which describes software that writes data past the end or before the beginning of the intended buffer. In this case, the vulnerability manifests as a heap-based buffer overflow in vCenter Server's DCERPC protocol handler. When processing specially crafted DCERPC network packets, the server allocates a heap buffer for the incoming data but fails to properly validate the packet size or content length before writing the data. This allows the attacker to overflow the heap buffer, corrupting adjacent heap metadata and data structures. Heap overflows can be leveraged by attackers to achieve arbitrary code execution by overwriting function pointers, vtable entries, or other control data stored on the heap. Learn more about CWE-787
Impact Analysis
Remote Code Execution on Critical Infrastructure is the primary impact of CVE-2024-37079. VMware vCenter Server is the centralized management platform for VMware vSphere environments, controlling all ESXi hosts, virtual machines, networking, and storage in a VMware deployment. Compromising vCenter Server gives an attacker control over the entire virtualization infrastructure.
Confidentiality Impact is maximum (C:H). An attacker executing code on vCenter Server can access credentials for all managed ESXi hosts, virtual machine configurations and snapshots, encryption keys for VM encryption, and potentially all data stored on virtual machines across the managed environment. vCenter stores administrative credentials and certificates that provide access to the entire vSphere deployment.
Integrity Impact is maximum (I:H). With code execution on vCenter, the attacker can modify virtual machine configurations, inject malicious code into VM templates, alter network and storage configurations, create or destroy virtual machines, and modify security settings across the entire virtualization platform. This enables sophisticated supply-chain attacks where the attacker compromises VM templates used by the organization.
Availability Impact is maximum (A:H). Control over vCenter enables the attacker to shut down virtual machines, disconnect storage, disrupt networking, or destroy the entire virtual infrastructure. For organizations running their production workloads on VMware, this could result in a complete business outage affecting all applications and services.
Strategic Value of Target: VMware vCenter Server represents one of the highest-value targets in enterprise infrastructure. A single compromised vCenter instance typically manages dozens to thousands of virtual machines across multiple data centers. The EPSS score of 0.82964 (99.2nd percentile) reflects the extreme attractiveness of this target to attackers. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2024-37079 is confirmed as actively exploited in the wild, as evidenced by its inclusion in CISA's KEV catalog with a remediation deadline of February 13, 2026. The EPSS score of 0.82964 places it in the 99.2nd percentile, indicating that it is among the most frequently targeted vulnerabilities tracked by EPSS.
Exploitation Characteristics: The vulnerability requires no authentication, no user interaction, and has low attack complexity. An attacker with network access to the vCenter Server DCERPC service can send a crafted packet to trigger the heap overflow. While heap overflow exploitation is generally more complex than stack overflow exploitation, the reliability of modern heap exploitation techniques and the high-value nature of the target make this vulnerability extremely attractive to sophisticated threat actors.
Attack Surface: VMware vCenter Server typically requires network accessibility from all managed ESXi hosts and administrative workstations. In many deployments, vCenter is accessible from broad network segments or even the public internet. The DCERPC protocol is a fundamental component of the vCenter service infrastructure and cannot be easily disabled without breaking functionality.
Vendor Response: Broadcom (which acquired VMware) has released security advisories and patches through their support portal. The availability of vendor patches indicates mature understanding of the vulnerability and the ability to develop reliable fixes.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, VMware infrastructure has been a primary target for ransomware groups in recent years, with campaigns specifically designed to encrypt VMDK files on ESXi hosts. A vCenter compromise provides the perfect staging point for such attacks.
Remediation
-
Apply the Broadcom security update immediately. Download and install the patched version of vCenter Server from the Broadcom security advisory. For vCenter Server 8.0, apply the latest update that addresses CVE-2024-37079. For vCenter Server 7.0, apply the corresponding security patch. Test the update in a non-production environment first if possible, but given the severity and active exploitation, prioritize rapid deployment.
-
Update VMware Cloud Foundation if running affected versions 4.0 through 5.2. Cloud Foundation includes vCenter Server as a core component, and the vulnerability must be addressed through the Cloud Foundation update process. Follow the VMware Cloud Foundation lifecycle management procedures to apply the security update.
-
Restrict network access to vCenter Server as an immediate mitigation while planning the update. Use firewall rules or network segmentation to limit which systems can reach the vCenter Server on the DCERPC port. Ensure that vCenter is only accessible from the management network and trusted administrative workstations. Block all internet-facing access to vCenter Server.
-
Monitor vCenter Server for indicators of compromise by reviewing authentication logs, service logs, and network connection patterns. Look for unexpected DCERPC traffic patterns, unauthorized administrative actions, new user accounts, modified permissions, or unusual virtual machine operations. Deploy network-based intrusion detection with signatures for CVE-2024-37079 exploitation attempts.
-
Implement defense-in-depth measures for the VMware management plane. Deploy vCenter Server behind a dedicated management firewall, enable audit logging and forward logs to a SIEM, implement multi-factor authentication for vCenter administrative access, and regularly review user accounts and permissions. Consider deploying VMware's built-in firewall capabilities to further restrict vCenter network exposure.
Technical Details
CVE-2024-37079 is a heap-overflow vulnerability in the DCERPC (Distributed Computing Environment / Remote Procedure Call) protocol implementation within VMware vCenter Server. The vulnerability allows remote code execution through specially crafted network packets.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 9.8. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L). No authentication (PR:N) or user interaction (UI:N) is required. The scope is unchanged (S:U), and all impact metrics are maximum (C:H/I:H/A:H), reflecting the complete system compromise achievable through remote code execution on vCenter Server.
DCERPC Protocol Context: DCERPC is a protocol used extensively within VMware's management infrastructure for inter-service communication, including vCenter-to-ESXi host communication and internal vCenter service interactions. The protocol handles serialized data structures transmitted over the network, and the vulnerable code path processes incoming DCERPC requests.
Heap Overflow Mechanism: When vCenter Server receives a DCERPC network packet, the protocol handler parses the packet and allocates heap memory to store the deserialized data. The vulnerability occurs because the code does not properly validate the size fields within the DCERPC packet before copying data into the allocated buffer. An attacker can craft a packet with manipulated size fields that cause a smaller-than-necessary buffer to be allocated, while the actual data payload exceeds this allocation. The resulting heap overflow overwrites adjacent heap structures.
Exploitation Path: Heap overflow exploitation in modern systems typically involves corrupting heap metadata or adjacent object data to gain control of execution flow. In the context of vCenter Server, the attacker can leverage the overflow to overwrite function pointers in adjacent heap objects, modify virtual method tables (vtables) used by C++ objects, or corrupt heap management structures to gain a write-what-where primitive. This ultimately enables the attacker to redirect execution to attacker-controlled shellcode or leverage return-oriented programming (ROP) techniques to achieve arbitrary code execution.
Affected Components: The vulnerability affects both VMware vCenter Server (versions 7.0 and 8.0) and VMware Cloud Foundation (versions 4.0 through 5.2). Both products include the same vulnerable DCERPC implementation. The vCenter Appliance (VCSA) runs on a Linux-based operating system, and code execution on the appliance provides root-level access to the management platform.
Frequently Asked Questions
What is CVE-2024-37079?
CVE-2024-37079 is a critical heap-overflow vulnerability in VMware vCenter Server's DCERPC protocol implementation that enables unauthenticated remote code execution. It has a CVSS score of 9.8, affects vCenter Server 7.0 and 8.0 as well as VMware Cloud Foundation 4.0 through 5.2, and is actively exploited in the wild.
Why is a vCenter Server vulnerability so dangerous?
VMware vCenter Server is the central management platform for an organization's entire VMware virtualization infrastructure. Compromising vCenter gives an attacker control over all managed ESXi hosts and virtual machines, access to stored credentials and certificates, and the ability to modify or destroy the entire virtual environment. A single vCenter compromise can affect hundreds or thousands of virtual machines.
Can this vulnerability be exploited from the internet?
Yes, if vCenter Server is accessible from the internet, which unfortunately occurs in some deployments. The vulnerability requires only network access to the DCERPC service, no authentication, and no user interaction. Even in environments where vCenter is not internet-facing, an attacker who gains access to the management network through any other means can exploit this vulnerability.
Is VMware Cloud Foundation also affected?
Yes. VMware Cloud Foundation versions 4.0 through 5.2 include the vulnerable vCenter Server component and are affected by CVE-2024-37079. Organizations running Cloud Foundation should apply the security update through the Cloud Foundation lifecycle management process.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.