{"id":"CVE-2019-5544","kind":"vulnerability","aliases":["CVE-2019-5544"],"related":[],"title":"VMware VMware ESXi and Horizon DaaS: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability","description":"VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"VMware ESXi and Horizon DaaS ship an OpenSLP service with a heap-based buffer overflow that a network attacker can trigger through port 427. A successful exploit gives remote code execution on the host, and CISA lists it as actively exploited, with ransomware use noted.","severity":"critical","cvss":9.8,"epss":0.98129,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware VMware ESXi and Horizon DaaS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["esxi","exploited","horizon-daas","ransomware","vendor","vmware","vsphere"],"not_affected_if":["patched-build","slp-disabled-and-port-427-blocked"],"how_to_check":"Check the ESXi build number on each host (vmware -v or the vSphere client) and compare it to the VMware advisory VMSA-2019-0022 listed in the sources.\nCheck whether the OpenSLP service (slpd) is running on the host and whether TCP/UDP 427 is reachable from untrusted networks.","fix":"Apply the VMware patch for ESXi and Horizon DaaS per the vendor advisory, as CISA requires.\nIf patching is not immediate, disable the OpenSLP service and block port 427 at the network edge; exact steps are unknown from the sources.","status":"open","published_at":"2019-12-06T16:15:11+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:34+00:00","updated_at":"2026-10-23T20:29:34+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:29:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the VMware patch for ESXi and Horizon DaaS per the vendor advisory, as CISA requires.\nIf patching is not immediate, disable the OpenSLP service and block port 427 at the network edge; exact steps are unknown from the sources.","summary":"VMware ESXi and Horizon DaaS ship an OpenSLP service with a heap-based buffer overflow that a network attacker can trigger through port 427. A successful exploit gives remote code execution on the host, and CISA lists it as actively exploited, with ransomware use noted.","category":"vendor","who_cares":["vmware","esxi","vsphere","horizon-daas"],"confidence":0.8,"analyst_note":"Confirm the fixed ESXi and Horizon DaaS build numbers and the mitigation steps from the VMware advisory VMSA-2019-0022; the sources given do not list them.","how_to_check":"Check the ESXi build number on each host (vmware -v or the vSphere client) and compare it to the VMware advisory VMSA-2019-0022 listed in the sources.\nCheck whether the OpenSLP service (slpd) is running on the host and whether TCP/UDP 427 is reachable from untrusted networks.\nunknown","needs_analyst":true,"not_affected_if":["patched-build","slp-disabled-and-port-427-blocked"],"severity_if_unknown":"critical"},"cost_usd":0.000458,"input_tokens":2184,"output_tokens":480,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2019':20A,23A '-5544':21A,24A '427':64B,113C 'access':110C 'action':129C 'activ':80B 'allow':105C 'and':28A 'appli':130C 'attack':59B,107C 'base':15A,53B,100C 'buffer':16A,54B,101C 'cisa':76B,127C 'code':70B,125C 'contain':96C 'cve':19A,22A 'daa':6A,11A,35B,44B,94C 'daas':30A 'desktop':90C 'esxi':3A,8A,27A,31B,41B,87C 'execut':71B,126C 'exploit':32B,67B,81B 'give':68B 'heap':14A,52B,99C,117C 'heap-bas':13A,51B,98C 'horizon':5A,10A,29A,34B,43B,89C 'horizon-daa':33B 'host':74B 'instruct':134C 'list':77B 'network':58B,109C 'note':85B 'openslp':12A,47B,95C,120C 'overflow':17A,55B,102C 'overwrit':115C 'per':132C 'perform':123C 'port':63B,112C 'ransomwar':36B,83B 'remot':69B,124C 'requir':128C 'servic':48B,93C,121C 'ship':45B 'success':66B 'trigger':61B 'updat':131C 'use':84B 'vendor':37B,133C 'vmware':1A,2A,7A,25A,26A,38B,40B,86C 'vsphere':39B 'vulner':18A,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-06T16:15:11+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-5544","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5544","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-5544","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5544","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-5544","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5544","severity":null,"published_at":"2019-12-06T16:15:11+00:00","modified_at":"2026-06-17T02:37:52+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}