---
id: "CVE-2019-5544"
kind: "vulnerability"
aliases: ["CVE-2019-5544"]
title: "VMware VMware ESXi and Horizon DaaS: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.98129
exploited: true
status: "open"
category: "vendor"
products: [{"name": "VMware VMware ESXi and Horizon DaaS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["esxi", "exploited", "horizon-daas", "ransomware", "vendor", "vmware", "vsphere"]
not_affected_if: ["patched-build", "slp-disabled-and-port-427-blocked"]
published_at: "2019-12-06T16:15:11+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5544", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5544", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5544", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# VMware VMware ESXi and Horizon DaaS: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

VMware ESXi and Horizon DaaS ship an OpenSLP service with a heap-based buffer overflow that a network attacker can trigger through port 427. A successful exploit gives remote code execution on the host, and CISA lists it as actively exploited, with ransomware use noted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware VMware ESXi and Horizon DaaS affected ? fixed ?

## How to check

Check the ESXi build number on each host (vmware -v or the vSphere client) and compare it to the VMware advisory VMSA-2019-0022 listed in the sources.
Check whether the OpenSLP service (slpd) is running on the host and whether TCP/UDP 427 is reachable from untrusted networks.

## Fix

Apply the VMware patch for ESXi and Horizon DaaS per the vendor advisory, as CISA requires.
If patching is not immediate, disable the OpenSLP service and block port 427 at the network edge; exact steps are unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5544
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-5544
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-5544

## From the sources

VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_