CVE-2024-43518

FAQ

According to the CVSS metric, user interaction is required (UI:R) and privileges required are none (PR:N). What does that mean for this vulnerability?

An unauthorized attacker must wait for a user to initiate a connection.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

This attack requires an admin user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability?

An attacker could exploit the vulnerability by remotely managing another machine's Telephony server using the tapisnap.dll tool. This could result in a heap-based buffer out-of-bounds write due to malicious data returned by the Telephony server's RPC interface.