Read the docs
TI-2021-06354 Aliases CVE-2021-24038GHSA-gr73-xmrv-34fc

Improper privilege management in Meta Oculus Desktop

Priority LOW 33CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507.

Why it matters now

EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Oculus Desktop (Facebook): 31.1.0.67.507

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaOculus Desktopbefore 31.1.0.67.50731.1.0.67.507Patch availableCNA
  • Oculus Desktop VendorMeta Affected before 31.1.0.67.507 Fixed in 31.1.0.67.507 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oculus:desktop:*:*:*:*:*:*:*:*1.39 to before 31.1.0.67.507VulnerableOculus
  • cpe:2.3:a:oculus:desktop:*:*:*:*:*:*:*:* Versions 1.39 to before 31.1.0.67.507 Vulnerable ·Oculus

Remediation

  • Fix · CNA Oculus Desktop (Facebook) Fixed in 31.1.0.67.507

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24038
  2. 2026-10-03 Alias added: GHSA-gr73-xmrv-34fc

References

Advisory 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences