Critical severity9.8CISA KEVNVD Advisory· Published Oct 25, 2023· Updated Jun 17, 2026
CVE-2023-34048
CVE-2023-34048
Description
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
40cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*+ 38 more
- cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*range: >=4.0,<=5.5
- cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*
- cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: 8.0
- VMware/VMware Cloud Foundation (VMware vCenter Server)v5Range: 5.x
Patches
Vulnerability mechanics
References
3- www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-servernvdExploitThird Party Advisory
- www.vmware.com/security/advisories/VMSA-2023-0023.htmlnvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
1- Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersectTenable Blog · May 27, 2026