CVE-2025-34522: Critical Heap Overflow in Arcserve UDP

CVE-2025-34522 is a critical flaw (CVSS 9.8) in Arcserve Unified Data Protection (UDP). An unauthenticated heap based buffer overflow in input parsing can cause crashes or remote code execution. It affects all UDP versions before 10.2. Upgrade to 10.2, or apply the patch Arcserve provides for supported older versions.

What's affected

The record says the issue affects all UDP versions prior to 10.2. It then gives the remediation path by version:

• UDP 10.2 includes the necessary patches and needs no action.
• Versions 8.0 through 10.1 are supported and need either a patch or an upgrade to 10.2.
• Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2.

Arcserve published an important security bulletin for all UDP customers. The page needs a browser to render, so I could not read its patch details. Open the bulletin itself and follow its instructions for your exact version.

How to check if you're exposed

Open the UDP console and read the installed version from the About or Help menu. Compare it with the list above. Anything below 10.2 is in scope unless the vendor's patch has been applied, and the bulletin explains how to confirm that.

Then look at where UDP is reachable. The record says the overflow can be triggered without authentication, so reachability of the service ports is the key question. List the networks that can connect to the console and to the agents' service ports, and check whether any of them are exposed to the internet.

Backup servers hold copies of everything, so write down which servers and workloads each UDP instance protects. That tells you how bad a compromise would be.

What to do now

1. Inventory every Arcserve UDP server and note its version.
2. Read the Arcserve security bulletin for your release line.
3. Upgrade to 10.2, or apply the patch if you are on a supported release from 8.0 through 10.1.
4. If you run 7.x or older, schedule the move to 10.2 as an urgent project.
5. Restrict network access to the UDP console and services to trusted management hosts.
6. Review logs for unusual logins and unexpected administrative actions.

Why it matters

The class is heap based buffer overflow (CWE-122). The record says the code does not check bounds properly while parsing input, so crafted input can overwrite heap memory. Because it needs no login and no user action, the exposure comes down to who can reach the service.

The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Even so, backup software is a high value target. An attacker with control of the backup system can read stored data, or damage the copies you would need after an incident. Treat the server as part of your core security perimeter.

Quick check

Sources

• Arcserve security bulletin for UDP customers

Last reviewed: 18 October 2026.