CVE-2023-34059

7.0 highEPSS 0.4%

High (7.0). EPSS 0.4% chance of exploitation in the next 30 days.

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.

Severity

CVSS 3.1

7.0 high

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-404
Published: 2023-10-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
vmware:open_vm_tools

References

http://www.openwall.com/lists/oss-security/2023/10/27/2
http://www.openwall.com/lists/oss-security/2023/10/27/3
http://www.openwall.com/lists/oss-security/2023/11/26/1
http://www.openwall.com/lists/oss-security/2023/11/27/1
https://lists.debian.org/debian-lts-announce/2023/11/msg00002.html

Check your stack JSON