CVE-2019-5544: OpenSLP heap out-of-bounds write in VMware ESXi and Horizon DaaS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reachability, CISA KEV listing with known ransomware use and near-maximum EPSS probability make this an urgent patch target.

What it is

OpenSLP as shipped in VMware ESXi and Horizon DaaS contains a heap overwrite (out-of-bounds write) flaw. VMware rates it Critical with a maximum CVSSv3 base score of 9.8, and the flaw is remotely reachable without authentication or user interaction. Because ESXi is a core virtualization platform, successful exploitation can compromise the hypervisor layer itself.

Impact

An unauthenticated remote attacker can overwrite heap memory, which can lead to code execution in the context of the vulnerable service and full compromise of the host. On ESXi this means potential control of the hypervisor and the workloads it runs.

Attack surface

Reached over the network via the OpenSLP service (CVSS vector AV:N/AC:L/PR:N/UI:N), so no authentication or user interaction is required. Any host exposing the affected OpenSLP service is in scope.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.97258 (99.9th percentile), indicating active exploitation is expected. The record does not name specific ransomware groups.

What to do

• Apply the vendor updates referenced in VMware advisory VMSA-2019-0022 and the Red Hat, Fedora and Gentoo errata.
• If OpenSLP is not required, disable or uninstall it on ESXi and Horizon DaaS hosts.
• Restrict network access to the OpenSLP service (port 427) to trusted management networks only.
• Verify ESXi and Horizon DaaS builds against the fixed versions in the vendor advisory and remediate any that remain unpatched.
• Monitor for and investigate unexpected service restarts or crashes on ESXi hosts that could indicate exploitation attempts.

Detection

• Monitor ESXi and Horizon DaaS host logs for OpenSLP service crashes, restarts or abnormal termination.
• Alert on network traffic to UDP/TCP 427 from untrusted sources or unexpected internal hosts.
• Hunt for post-exploitation activity on ESXi hosts such as new or modified binaries, unexpected processes and unauthorized vSphere accounts.
• Correlate host telemetry with CISA KEV and EPSS signals to prioritize scanning for unpatched OpenSLP instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.