A heap-based buffer overflow vulnerability (CWE-122) exists in the input parsing logic of Arcserve Unified Data Protection (UDP) prior to version 10.2. The vulnerability can be triggered remotely without authentication by sending specially crafted input, leading to heap memory corruption. This may result in application crashes or remote code execution within the context of the affected process. The vulnerability has a CVSS 4.0 score of 9.2 (critical) with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. UDP 10.2 contains the necessary patches to fix this issue. Versions 8.0 through 10.1 are supported and require patching or upgrading, while versions 7.x and earlier are unsupported and must be upgraded to 10.2.

The vulnerability allows unauthenticated remote attackers to cause heap memory corruption by sending crafted input to the UDP service. This can lead to application crashes or remote code execution, potentially resulting in full compromise of the affected system. The impact affects confidentiality, integrity, and availability of the system running the vulnerable UDP versions.

Arcserve UDP version 10.2 includes an official fix that fully remediates this vulnerability. Users running supported versions 8.0 through 10.1 should apply the patch or upgrade to version 10.2 immediately. Systems running unsupported versions 7.x or earlier must upgrade to version 10.2 to address the issue. No other mitigations are indicated or required beyond applying the official patch or upgrade.