What is CVE-2025-34522?

CVE-2025-34522 is a critical-severity vulnerability in Arcserve Udp, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-08-27.

How severe is CVE-2025-34522?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2025-34522 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Arcserve Udp

CVE-2025-34522

A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bou…

Vulnerability class: Buffer Overflow

EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Arcserve Udp — versions 7.0
Arcserve Unified Data Protection (Udp) — versions 10.2, 8.0, 0

Weakness classification (CWE)

CWE-122 — Heap-based Buffer Overflow

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

disclosure@vulncheck.com (vendor-advisory, patch, Vendor Advisory)

Frequently asked questions

What is CVE-2025-34522?: CVE-2025-34522 is a critical-severity vulnerability in Arcserve Udp, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-08-27.
How severe is CVE-2025-34522?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2025-34522 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.