# VMware vCenter Server heap overflow and privilege escalation

Published: 2024-06-18 · Severity: elevated
Canonical: https://vorant.io/reports/f13f37ae-b95a-5096-bd9d-96fef7ab7a56/vmware-vcenter-server-heap-overflow-and-privilege-escalation

> Critical buffer overflow and privilege escalation flaws in VMware vCenter Server require immediate patching to prevent code execution and root compromise.

Broadcom's VMware vCenter Server, a virtualization management platform, contains multiple critical vulnerabilities affecting its DCE/RPC protocol implementation. Two heap-based buffer overflow vulnerabilities (CVE-2024-37079 and CVE-2024-37080) allow attackers with vCenter Server access to execute arbitrary code. Additionally, CVE-2024-37081 is a local privilege escalation flaw permitting non-administrator users to escalate to root privileges. The Japanese Information-technology Promotion Agency (IPA) issued this alert warning that exploitation could lead to widespread compromise of virtualized infrastructure. Broadcom has released patched versions and defenders must apply updates immediately according to vendor guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2024-37079 (KEV), CVE-2024-37080, CVE-2024-37081 (weaponized)

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20240619.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f13f37ae-b95a-5096-bd9d-96fef7ab7a56/vmware-vcenter-server-heap-overflow-and-privilege-escalation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup