CVE-2023-6334: Medium Buffer Overflow in HYPR Workforce Access for Windows

CVE-2023-6334 is a Medium severity (CVSS 5.3) buffer overflow in HYPR Workforce Access on Windows, in versions before 8.7. The record gives no exploit detail beyond the weakness class. HYPR lists the affected range, so upgrade every endpoint to Workforce Access 8.7 or later.

What's affected

The NVD record states the range.

• Affected: HYPR Workforce Access on Windows, versions before 8.7.
• Fixed: 8.7. The record gives "before 8.7" as the affected range, and HYPR's advisories page is the vendor source.
• Severity: CVSS 5.3 Medium. The weakness is CWE-120, buffer copy without checking size of input.
• Detail: the record says only what the class of weakness is. HYPR's advisory page did not show further detail when I fetched it, so I will not guess at exploit steps.

Workforce Access is installed on managed endpoints. A flaw in code that runs on every one of them deserves a prompt update, even when the score is not the highest.

How to check if you're exposed

Find the installed version on every endpoint.

1. Use your endpoint management or software inventory tool to list installs of HYPR Workforce Access and their versions.
2. On Windows, check Apps and Features or the installed programs list. On macOS, check the application's About window or the installed package list.
3. Anything below 8.7 is in range.

Ask whoever manages identity for your workstations which version was rolled out and whether auto update is configured. Also confirm whether older laptops or lab images carry an old installer.

What to do now

1. Upgrade HYPR Workforce Access to version 8.7 or later on every endpoint where it is installed.
2. Use your endpoint management tool to push the update and report the installed version per device.
3. Check HYPR's security advisories page for any update to the guidance after this review date.
4. Limit local administrator rights where you can, since local privilege issues need a local foothold first.
5. Add the product to your software inventory, with version, so the next advisory can be matched in a query.

Why it matters

The weaknesses are CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-120, a classic buffer copy without checking the size of input. In plain terms, the software copies data into a fixed size memory area without making sure the data fits.

Memory safety bugs in code that runs with high privilege on an endpoint matter, because a bug that starts as a crash can sometimes become more. The score of 5.3 is moderate. The vector in the record is local, high complexity and needs low privileges, with low integrity impact and high availability impact, so the realistic outcome is disruption by a local user. The kev flag is false and nothing says it is exploited.

Quick check

Sources

• HYPR security advisories (listed in the record, the page did not show detail for this CVE when fetched)
• NVD record

Last reviewed: 19 October 2026.