VMware vCenter Server Out-of-Bounds Write Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2023-34048 · Published 25/10/2023 · updated 17/06/2026

VMware vCenter Server Out-of-Bounds Write Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/01/2024. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
vcenter server vmware	`= 7.0= 8.0≥ 4.0, ≤ 5.5`	No fix yet

Description

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

References

vmware.com/security/advisories/VMSA-2023-0023.html · Vendor Advisory
vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-34048

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free