---
id: 7294
title: "[CVE-2024-38018] SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization"
cve: CVE-2024-38018
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/sharepoint_properties_deser/"
published_at: "2025-07-16T09:42:05Z"
tags: ["rce", "deserialization", "sharepoint", "webpart", "cve-2024-38018", "binaryformatter"]
phying_url: "https://phying.com/item/7294"
lang: en
---

# [CVE-2024-38018] SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization

## Summary

CVE-2024-38018: SPSerializationBinder allowed binary deserialization of SafeControls classes via WebPart attached properties, enabling RCE with a crafted ysoserial payload.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2024-38018
- **Published:** 2025-07-16T09:42:05Z
- **Original:** https://blog.viettelcybersecurity.com/sharepoint_properties_deser/
- **Phying News:** https://phying.com/item/7294