CVE-2019-5544 is an openslp heap-based buffer overflow vulnerability in VMware VMware ESXi and Horizon DaaS. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in VMware ESXi and Horizon DaaS
CVE-2019-5544 is a heap-based buffer overflow in OpenSLP, which makes the issue dangerous because memory corruption can turn a network-facing parsing bug into code execution, denial of service, or broader system compromise when the vulnerable service is reachable.
Because the affected products are infrastructure platforms, exploitation can affect multiple hosted workloads at once. For version and patch specifics, use the CVE Program record and the vendor advisory rather than relying on secondary summaries.
How organisations assess exposure and urgency
The first question is whether any ESXi or Horizon DaaS systems still expose the vulnerable OpenSLP service, especially on management networks or interfaces reachable from less trusted segments. Asset inventory matters here because untracked hosts often remain unpatched long after the initial disclosure.
Exposure should be cross-checked against vendor guidance and exploit prioritisation sources, including the NIST National Vulnerability Database and the CISA KEV catalogue referenced in the primary definition. If a host is both present and externally or broadly reachable, it deserves immediate attention.
Mitigation and compensating controls
The preferred response is to apply the vendor fix or mitigation as soon as operationally possible. When patching is delayed, reduce exposure by removing unnecessary network reachability to the affected service, segmenting management access, and disabling only the specific service path if the platform and support guidance allow it.
For prioritisation and change planning, the Vulnerability Management Guide is useful because it ties KEV status, asset scope and remediation workflow together. In practice, a KEV-listed vulnerability should not wait for a routine maintenance window if the service is exposed.
Detection and post-exploitation review
Heap corruption in a management-facing service warrants review for evidence of exploitation, not just successful patching. Organisations should examine host telemetry, service logs, crash events, unexpected restarts, and any signs that the vulnerable process behaved abnormally before remediation.
If compromise is suspected, validate whether the attacker used the service as an entry point for persistence or lateral movement. The Breach and Attack Simulation Guide is a practical reference for testing whether current detections would have surfaced exploitation-like activity and follow-on movement.
Risk and Threat Considerations
Software flaws in management-plane infrastructure create outsized risk because one exposed service can give an attacker leverage over many systems at once. In a product like ESXi, compromise can affect host integrity, virtual machine availability, and the trust boundary around the management plane.
Failure mechanism: A crafted network request can trigger heap corruption in OpenSLP, which may allow code execution or destabilise the service before defenders notice unusual behaviour.
Impact: Successful exploitation can lead to service interruption, host compromise, and downstream exposure of workloads that depend on the affected platform.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires prioritised scanning, remediation and verification of exposed systems. |
| Recommendation — Prioritise discovery, remediation and verification for exposed ESXi and Horizon DaaS hosts. | ||
| NIST CSF 2.0 | PR.PS-03 — Configuration Management | Mitigation depends on securely configuring and reducing exposure of the vulnerable service. |
| DE.CM-01 — Networks and services are monitored to find potentially adverse events | Exploit attempts against a management service require monitoring for abnormal service and host behaviour. | |
| Recommendation — Harden service exposure and apply approved configuration changes that reduce attack surface. Monitor the affected service and host for crashes, restarts and suspicious management-plane activity. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The vulnerability is a software flaw that demands prompt remediation and verification. |
| SI-4 — System Monitoring | Post-exploit review needs detection of malicious or anomalous activity on the affected hosts. | |
| Recommendation — Track the flaw to closure with timely patching, mitigation and post-remediation validation. Increase monitoring for exploit-like behaviour and post-compromise indicators on vulnerable systems. | ||
Practitioner Guidance
Why practitioners should care: Prioritise this class of vulnerability as an infrastructure issue, not a single-host bug. If the vulnerable service is reachable anywhere meaningful, the blast radius can be much larger than the number of affected servers suggests.
Practitioner takeaway: Treat KEV-listed, network-reachable management-plane flaws as immediate remediation candidates, and verify after patching that the vulnerable service is no longer exposed or exploitable.