CVE-2019-5544

Name: CVE-2019-5544
Creator: NVD / NIST
Published: 2019-12-06T16:15:11.467+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10Actively ExploitedEPSS 96.82%

Last modified Jun 17, 2026

CVE-2019-5544 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.. CISA has confirmed active exploitation in the wild. EPSS estimates a 96.82% chance of exploitation in the next 30 days.

Description

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

96.82%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by May 3, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Vmware	Horizon Daas	>= 8.0.0, < 9.0.0.0
Vmware	Esxi	6.0
Vmware	Esxi	6.5
Vmware	Esxi	6.7
Redhat	Enterprise Linux Desktop	6.0
Redhat	Enterprise Linux Desktop	7.0
Redhat	Enterprise Linux For Ibm Z Systems	6.0_s390x
Redhat	Enterprise Linux For Ibm Z Systems	7.0_s390x
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.7_s390x
Redhat	Enterprise Linux For Power Big Endian	6.0_ppc64
Redhat	Enterprise Linux For Power Big Endian	7.0_ppc64
Redhat	Enterprise Linux For Power Big Endian Eus	7.7_ppc64
Redhat	Enterprise Linux For Power Little Endian	7.0_ppc64le
Redhat	Enterprise Linux For Power Little Endian Eus	7.7_ppc64le
Redhat	Enterprise Linux Server	6.0
Redhat	Enterprise Linux Server	7.0
Redhat	Enterprise Linux Server Aus	7.7
Redhat	Enterprise Linux Server Eus	7.7
Redhat	Enterprise Linux Server Tus	7.7
Redhat	Enterprise Linux Workstation	6.0
Redhat	Enterprise Linux Workstation	7.0
Openslp	Openslp	<= 2.0.0
Fedoraproject	Fedora	30
Fedoraproject	Fedora	31

References

http://www.openwall.com/lists/oss-security/2019/12/10/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/12/11/2Mailing List, Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2019-0022.htmlPatch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:4240Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0199Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF/Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQULBCJVI5NNWZ3PGWXGXWG/Release Notes
https://security.gentoo.org/glsa/202005-12Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/12/10/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/12/11/2Mailing List, Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2019-0022.htmlPatch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:4240Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0199Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF/Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQULBCJVI5NNWZ3PGWXGXWG/Release Notes
https://security.gentoo.org/glsa/202005-12Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5544US Government Resource

Timeline

Published: Dec 6, 2019
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2019-5544?

How severe is CVE-2019-5544?

CVE-2019-5544 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 96.82% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2019-5544?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-5544?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST