CVE-2025-34523: CWE-122 Heap-based Buffer Overflow in Arcserve Unified Data Protection (UDP)
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attacker can corrupt heap memory, potentially causing a denial of service or enabling arbitrary code execution depending on the memory layout and exploitation techniques used. This vulnerability is similar in nature to CVE-2025-34522 but affects a separate code path or component. No user interaction is required, and exploitation occurs in the context of the vulnerable process. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue.
AI Analysis
Technical Summary
This vulnerability is a heap-based buffer overflow (CWE-122) in Arcserve Unified Data Protection (UDP) network input handling code. It allows remote attackers to send specially crafted data without authentication to corrupt heap memory. The impact ranges from denial of service to potential arbitrary code execution depending on exploitation conditions. It affects all UDP versions prior to 10.2. The flaw is similar to CVE-2025-34522 but affects a different code path or component. UDP 10.2 contains the necessary patches to fix this vulnerability.
Potential Impact
Successful exploitation can cause heap memory corruption leading to denial of service or arbitrary code execution in the context of the vulnerable UDP process. No authentication or user interaction is required, increasing the risk of remote exploitation. The CVSS 4.0 score is 9.2 (critical), reflecting high attack vector and impact severity.
Mitigation Recommendations
Arcserve UDP version 10.2 includes the official fix for this vulnerability. Users should upgrade to version 10.2 to remediate the issue. Versions 8.0 through 10.1 require patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported and must be upgraded to 10.2. No other mitigations are indicated by the vendor advisory.
CVE-2025-34523: CWE-122 Heap-based Buffer Overflow in Arcserve Unified Data Protection (UDP)
Description
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attacker can corrupt heap memory, potentially causing a denial of service or enabling arbitrary code execution depending on the memory layout and exploitation techniques used. This vulnerability is similar in nature to CVE-2025-34522 but affects a separate code path or component. No user interaction is required, and exploitation occurs in the context of the vulnerable process. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue.
CVSS v4.0
Score 9.2critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a heap-based buffer overflow (CWE-122) in Arcserve Unified Data Protection (UDP) network input handling code. It allows remote attackers to send specially crafted data without authentication to corrupt heap memory. The impact ranges from denial of service to potential arbitrary code execution depending on exploitation conditions. It affects all UDP versions prior to 10.2. The flaw is similar to CVE-2025-34522 but affects a different code path or component. UDP 10.2 contains the necessary patches to fix this vulnerability.
Potential Impact
Successful exploitation can cause heap memory corruption leading to denial of service or arbitrary code execution in the context of the vulnerable UDP process. No authentication or user interaction is required, increasing the risk of remote exploitation. The CVSS 4.0 score is 9.2 (critical), reflecting high attack vector and impact severity.
Mitigation Recommendations
Arcserve UDP version 10.2 includes the official fix for this vulnerability. Users should upgrade to version 10.2 to remediate the issue. Versions 8.0 through 10.1 require patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported and must be upgraded to 10.2. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.612Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68af7981ad5a09ad006645c5
Added to database: 08/27/2025, 21:32:49 UTC
Last enriched: 08/05/2026, 13:39:26 UTC
Last updated: 08/23/2026, 22:52:05 UTC
Views: 251
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.