CVE-2025-34523: Critical Heap Overflow in Arcserve UDP (2)

CVE-2025-34523 is a critical flaw (CVSS 9.8) in Arcserve Unified Data Protection (UDP). An unauthenticated heap based buffer overflow in network facing input handling can cause denial of service or code execution. It affects all UDP versions before 10.2. Upgrade to 10.2, or apply the patch Arcserve provides for supported older versions.

What's affected

The record says the issue affects all UDP versions prior to 10.2. It then gives the remediation path by version:

• UDP 10.2 includes the necessary patches and needs no action.
• Versions 8.0 through 10.1 are supported and need either a patch or an upgrade to 10.2.
• Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2.

Arcserve published an important security bulletin for all UDP customers. The page needs a browser to render, so I could not read its patch details. Open the bulletin itself and follow its instructions for your exact version.

How to check if you're exposed

Open the UDP console and read the installed version from the About or Help menu. Compare it with the list above. Anything below 10.2 is in scope unless the vendor's patch has been applied, and the bulletin explains how to confirm that.

Then look at where UDP is reachable. The record says the flaw sits in network facing input handling and is reachable without authentication. List the networks that can connect to the console and to the agents' service ports, and check whether any of them are exposed to the internet.

Backup servers hold copies of everything, so write down which servers and workloads each UDP instance protects. That tells you how bad a compromise would be.

What to do now

1. Inventory every Arcserve UDP server and note its version.
2. Read the Arcserve security bulletin for your release line.
3. Upgrade to 10.2, or apply the patch if you are on a supported release from 8.0 through 10.1.
4. If you run 7.x or older, schedule the move to 10.2 as an urgent project.
5. Restrict network access to the UDP console and services to trusted management hosts.
6. Review logs for unusual logins and unexpected administrative actions.

Why it matters

The class is heap based buffer overflow (CWE-122). The record says this one is similar to CVE-2025-34522 but affects a separate code path or component, which is why it has its own identifier. Fixing one does not guarantee the other, so apply the full vendor patch or upgrade to 10.2 rather than a partial change.

The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Even so, backup software is a high value target. An attacker with control of the backup system can read stored data, or damage the copies you would need after an incident. Treat the server as part of your core security perimeter.

Quick check

Sources

• Arcserve security bulletin for UDP customers

Last reviewed: 18 October 2026.