Read the docs
TI-2022-13623 Aliases CVE-2022-31705GHSA-jx8f-jjvw-f6vf

Out-of-bounds write in VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro /…

Priority MEDIUM 40CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01132 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion (Fusion), VMware Cloud FoundationVMware ESXi (8.0 prior to ESXi80a-20842819, 7.0 prior to ESXi70U3si-20841705, VMware Workstation Pro / Player (16.x prior to 16.2.5), VMware Fusion Pro / Fusion (12.x prior to 12.2.5), VMware Cloud Foundation (4.x, 3.x)—No fix listedCNA
  • VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion (Fusion), VMware Cloud Foundation Vendor— Affected VMware ESXi (8.0 prior to ESXi80a-20842819, 7.0 prior to ESXi70U3si-20841705, VMware Workstation Pro / Player (16.x prior to 16.2.5), VMware Fusion Pro / Fusion (12.x prior to 12.2.5), VMware Cloud Foundation (4.x, 3.x) Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*16.0.0 to before 16.2.5VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*7.0 betaVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*7.0 update_1VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*7.0 update_1aVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*7.0 update_1bVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*7.0 update_1cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*7.0 update_1dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*7.0 update_1eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*7.0 update_2VulnerableVMware
  • cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 16.0.0 to before 16.2.5 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* Versions 7.0 beta Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*7.0 update_2aVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*7.0 update_2cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*7.0 update_2dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*7.0 update_2eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*7.0 update_3cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*7.0 update_3dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*7.0 update_3eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*7.0 update_3fVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*7.0 update_3gVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*8.0VulnerableVMware
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*12.0.0 to before 12.2.5VulnerableVMware
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.2.5 Vulnerable ·VMware
  • cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31705
  2. 2026-10-03 Alias added: GHSA-jx8f-jjvw-f6vf

References

Advisory 1

  • TI-2020-03488 Use after free in VMware ESXi KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-16135 Time-of-check time-of-use race condition in VMware ESXi KEVCVSS 3.1CRITICAL 9.3
  • TI-2025-16136 Out-of-bounds write in VMware ESXi KEVCVSS 3.1HIGH 8.2
  • TI-2010-03709 The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS)… KEVCVSS 3.1HIGH 7.8
  • TI-2024-24615 Authentication bypass in VMware ESXi KEVCVSS 3.1HIGH 7.2
See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences