CVE-2023-34048

Critical9.8 Published on Oct 25, 2023

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jan 22, 2024
US federal agencies must remediate it by Feb 12, 2024 (BOD 22-01)
First attack observed 83 days after disclosure

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Mar 6, 2026 Dec 4, 2025 Oct 9, 2025 Aug 11, 2025 Jul 28, 2025 Jul 28, 2025

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-787, CWE-787

Vendorsvmware

Affected products

Vendors	Product	Versions
vmware	vcenter server	<= 5.5

Vulnerabilities

VMware Workstation and Fusion: Two Flaws Allow Escape from the Virtual Machine

Broadcom fixed two critical VMware Workstation and Fusion flaws allowing VM escape to host. Upgrade to 26H1u1 to patch CVE-2026-59346, CVE-2026-59347.

Sep 4, 202623:09 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

VMware Workstation and Fusion: Two Flaws Allow Escape from the Virtual Machine