Read the docs
TI-2024-14840 Aliases CVE-2024-22252GHSA-4xp8-3mc6-r83c

Use-after-free in VMware ESXi

Priority MEDIUM 48CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03542 89th percentileScored 2026-11-07
Fix Fixed VMware ESXi: ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199VMware Workstation: 17.5.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware ESXi8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199Patch availableCNA
—VMware Workstation17.x to before 17.5.117.5.1Patch availableCNA
—VMware Fusion13.x to before 13.5.113.5.1Patch availableCNA
—VMware Cloud Foundation5.x; 4.x—No fix listedCNA
  • VMware ESXi Vendor— Affected 8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199 Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 Patch available CNA
  • VMware Workstation Vendor— Affected 17.x to before 17.5.1 Fixed in 17.5.1 Patch available CNA
  • VMware Fusion Vendor— Affected 13.x to before 13.5.1 Fixed in 13.5.1 Patch available CNA
  • VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*17.0.0 to before 17.5.1VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*7.0 update_1VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*7.0 update_1aVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*7.0 update_1bVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*7.0 update_1cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*7.0 update_1dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*7.0 update_1eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*7.0 update_2VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*7.0 update_2aVulnerableVMware
  • cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 17.0.0 to before 17.5.1 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*7.0 update_2cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*7.0 update_2dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*7.0 update_2eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*7.0 update_3VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*7.0 update_3cVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*7.0 update_3dVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*7.0 update_3eVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*7.0 update_3fVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*7.0 update_3gVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*7.0 update_3iVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*7.0 update_3jVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*7.0 update_3kVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*7.0 update_3lVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*7.0 update_3mVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*7.0 update_3nVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*7.0 update_3oVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:*7.0.0 bVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*8.0VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*8.0 aVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*8.0 bVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*8.0 cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*8.0 update_1VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*8.0 update_1aVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*8.0 update_1cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*8.0 update_2VulnerableVMware
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*13.0.0 to before 13.5.1VulnerableVMware
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* Versions 7.0 update_3 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* Versions 7.0 update_3i Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* Versions 7.0 update_3j Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* Versions 7.0 update_3k Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* Versions 7.0 update_3l Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* Versions 7.0 update_3m Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* Versions 7.0 update_3n Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* Versions 7.0 update_3o Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:* Versions 7.0.0 b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 13.0.0 to before 13.5.1 Vulnerable ·VMware
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

  • Fix · CNA VMware ESXi Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199
  • Fix · CNA VMware Workstation Fixed in 17.5.1
  • Fix · CNA VMware Fusion Fixed in 13.5.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    VMware ESXi ESXi70U3p-23307199, ESXi80U1d-23299997, ESXi80U2sb-23305545

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    Show all 4 records →
  • Release ·

    VMware Fusion, VMware Workstation 13.5.1, 17.5.1

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22252
  2. 2026-10-03 Alias added: GHSA-4xp8-3mc6-r83c

References

Advisory 1

  • TI-2020-03488 Use after free in VMware ESXi KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-16135 Time-of-check time-of-use race condition in VMware ESXi KEVCVSS 3.1CRITICAL 9.3
  • TI-2025-16136 Out-of-bounds write in VMware ESXi KEVCVSS 3.1HIGH 8.2
  • TI-2010-03709 The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS)… KEVCVSS 3.1HIGH 7.8
  • TI-2024-24615 Authentication bypass in VMware ESXi KEVCVSS 3.1HIGH 7.2
See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences