CVE-2024-38178: Microsoft Windows Scripting Engine type confusion memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and carries high EPSS probability, but exploitation requires user interaction and the CVSS base score is 7.5 rather than critical.

What it is

CVE-2024-38178 is a memory corruption flaw in the Microsoft Windows Scripting Engine, classified as a type confusion (CWE-843). It affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft has issued a patch. Because the scripting engine is a core component, a reliable memory corruption bug there is a serious risk to any unpatched Windows host.

Impact

Successful exploitation corrupts memory in a way that can lead to arbitrary code execution in the context of the affected process, giving the attacker the same privileges as the user running the scripting engine. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), meaning a victim must open or render attacker-controlled content that invokes the scripting engine. No authentication is needed on the attacker's side.

Exploitation

CVE-2024-38178 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2024-08-13 addition date, confirming exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.4138 (98.6th percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2024-38178 to all affected Windows 10, Windows 11 and Windows Server versions; prioritize internet-facing and user-workstation systems.
• Meet the CISA KEV remediation due date of 2024-09-03; if patching cannot be completed, follow vendor guidance or discontinue use of the affected product.
• Restrict execution of untrusted script content and block or sandbox legacy scripting engine use where business needs allow.
• Enforce email and web filtering to reduce delivery of malicious documents or pages that trigger the scripting engine.
• Track unpatched hosts against the affected product list and treat them as exposed until remediated.

Detection

• Monitor for crashes or abnormal process terminations in Windows scripting engine host processes (for example wscript.exe, cscript.exe, mshta.exe) on patched and unpatched endpoints.
• Hunt for scripting engine processes spawning unexpected child processes such as cmd.exe, powershell.exe or rundll32.exe.
• Review endpoint telemetry for documents or web content that invoke the scripting engine from email clients, browsers or Office applications.
• Correlate patch inventory against the affected Windows builds to find systems still missing the August 2024 update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.