# CVE-2023-34048

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2023-34048
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-01-22; CISA due date 2024-02-12
- EPSS: 99.23% (percentile 99.9)
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-03-11)
- Weakness: CWE-787
- Published: 2023-10-25

## Affected versions

- VMware VMware Cloud Foundation (VMware vCenter Server): affected 5.x; 4.x
- VMware VMware vCenter Server: affected >= 8.0 and < 8.0U2; >= 7.0 and < 7.0U3o

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.vmware.com/security/advisories/VMSA-2023-0023.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048
- [other] https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.