← Vulnerability feed

Vulnerability record · CVE-2024-38063 · published 13 August 2024

CVE-2024-38063: Windows TCP/IP stack integer underflow allows remote code execution

Microsoft · Windows 10 1507

CVE-2024-38063 is a critical remote code execution flaw in the Windows TCP/IP stack, classified as an integer underflow (CWE-191) with insufficient detail in the record. It affects a broad set of Windows 10, Windows 11 and Windows Server releases. Because the flaw is reachable over the network with no privileges or user interaction, it is a serious wormable-style risk for any exposed Windows host.

9.8 CVSS 3.1 Critical EPSS 71% · top 0.6% CWE-191 · CWE-191
9.8CVSS 3.1 base score
71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
15Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Windows TCP/IP Remote Code Execution Vulnerability

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, and a very high EPSS score make this an urgent patch-first issue despite no KEV listing.

What it is

CVE-2024-38063 is a critical remote code execution flaw in the Windows TCP/IP stack, classified as an integer underflow (CWE-191) with insufficient detail in the record. It affects a broad set of Windows 10, Windows 11 and Windows Server releases. Because the flaw is reachable over the network with no privileges or user interaction, it is a serious wormable-style risk for any exposed Windows host.

Impact

A remote, unauthenticated attacker can execute arbitrary code on the target system, potentially gaining full control of the host. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via the TCP/IP stack (AV:N, PR:N, UI:N), so no authentication or user interaction is required. Any Windows host with the affected stack reachable by an attacker is in scope.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.706, 99.4th percentile), indicating strong predicted exploitation activity. The only reference is the Microsoft patch advisory, so no public exploit details are confirmed in this record.

What to do

  • Apply the Microsoft August 2024 security update for CVE-2024-38063 on all affected Windows 10, Windows 11 and Windows Server systems.
  • Prioritize internet-facing and edge hosts, then patch internal systems in waves.
  • Restrict inbound network exposure of affected Windows hosts where patching cannot be immediate.
  • Monitor vendor guidance for any additional workarounds or mitigations tied to this CVE.

Detection

  • Monitor for unexpected crashes or restarts of the Windows TCP/IP stack or network services on affected hosts.
  • Alert on anomalous inbound network traffic patterns targeting Windows hosts that could precede exploitation.
  • Track patch compliance for CVE-2024-38063 across the affected Windows product list and flag unpatched internet-facing systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

15 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063 PatchVendor Advisory

Track CVE-2024-38063 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-33824Double free in Windows IKE Extension enables remote code executionA double free flaw (CWE-415) exists in the Windows IKE Extension, reachable over the network by an unauthenticated attacker. Successful exploitation …KEVEPSS 1.6%analysed9.8CVE-2017-8543Windows Search memory handling flaw allows remote code executionWindows Search fails to properly handle objects in memory, allowing an unauthenticated remote attacker to execute code on affected Windows systems. T…KEVEPSS 74%analysed8.8CVE-2026-21510Windows Shell protection mechanism failure allows security feature bypassWindows Shell contains a protection mechanism failure (CWE-693) that lets an unauthorized attacker bypass a security feature over a network. The flaw…KEVEPSS 24%analysed8.8CVE-2026-21513Microsoft MSHTML security feature bypass on WindowsCVE-2026-21513 is a protection mechanism failure (CWE-693) in the Microsoft MSHTML Framework that lets an unauthorized attacker bypass a security fea…KEVEPSS 16%analysed8.8CVE-2025-33073Windows SMB improper access control allows privilege elevationWindows SMB contains an improper access control flaw (CWE-284) that lets an authorized attacker elevate privileges over the network. Microsoft rates …KEVEPSS 83%analysed8.8CVE-2025-33053Microsoft Windows WebDAV Internet Shortcut File Path Control RCEWindows Internet Shortcut (.url) files allow external control of a file name or path, which an unauthorized attacker can abuse to execute code over a…KEVEPSS 87%analysed8.8CVE-2024-49039Windows Task Scheduler elevation of privilege via improper authenticationCVE-2024-49039 is an elevation of privilege flaw in the Windows Task Scheduler, classified as improper authentication (CWE-287). A local attacker wit…KEVEPSS 14%analysed8.8CVE-2024-43461Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. Th…KEVEPSS 54%analysed

Source: NIST National Vulnerability Database (record CVE-2024-38063), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.