CVE-2023-38036

The vulnerability exists in Ivanti Avalanche Manager, a mobile device management (MDM) and endpoint management solution. The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow), indicating that the application fails to properly validate input size before copying data into a fixed-size buffer. This is a stack or heap-based buffer overflow vulnerability likely triggered through network input to a management service endpoint. The affected product line manages enterprise mobile and desktop devices, making the management interface itself a high-value attack target. Versions before 6.4.1 contain the vulnerable code path; the vulnerability is network-accessible (AV:N) with no authentication required (PR:N) and no user interaction needed (UI:N), indicating the flaw likely exists in an unauthenticated service endpoint or protocol handler.