Use-after-free in VMware ESXi
Priority MEDIUM 43CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00645 51st percentileScored 2026-11-07
Fix Fixed VMware ESXi: ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199VMware Workstation: 17.5.1+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware ESXi | 8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199 | ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 | Patch available | CNA |
| — | VMware Workstation | 17.x to before 17.5.1 | 17.5.1 | Patch available | CNA |
| — | VMware Fusion | 13.x to before 13.5.1 | 13.5.1 | Patch available | CNA |
| — | VMware Cloud Foundation | 5.x; 4.x | — | No fix listed | CNA |
- VMware ESXi Vendor— Affected 8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199 Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 Patch available CNA
- VMware Workstation Vendor— Affected 17.x to before 17.5.1 Fixed in 17.5.1 Patch available CNA
- VMware Fusion Vendor— Affected 13.x to before 13.5.1 Fixed in 13.5.1 Patch available CNA
- VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 4.0 – 5.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | 17.0.0 to before 17.5.1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* | 7.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* | 7.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* | 7.0 update_1b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* | 7.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* | 7.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* | 7.0 update_1e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* | 7.0 update_2 | Vulnerable | VMware |
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 – 5.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 17.0.0 to before 17.5.1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* | 7.0 update_2a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* | 7.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* | 7.0 update_2d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* | 7.0 update_2e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* | 7.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* | 7.0 update_3c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* | 7.0 update_3d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* | 7.0 update_3e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* | 7.0 update_3f | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* | 7.0 update_3g | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* | 7.0 update_3i | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* | 7.0 update_3j | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* | 7.0 update_3k | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* | 7.0 update_3l | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* | 7.0 update_3m | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* | 7.0 update_3n | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* | 7.0 update_3o | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:* | 7.0.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* | 8.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* | 8.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* | 8.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* | 8.0 update_2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* | 13.0.0 to before 13.5.1 | Vulnerable | VMware |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
- cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* Versions 7.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* Versions 7.0 update_3i Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* Versions 7.0 update_3j Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* Versions 7.0 update_3k Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* Versions 7.0 update_3l Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* Versions 7.0 update_3m Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* Versions 7.0 update_3n Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* Versions 7.0 update_3o Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:* Versions 7.0.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
- cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 13.0.0 to before 13.5.1 Vulnerable ·VMware
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
Remediation
- Fix · CNA VMware ESXi Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199
- Fix · CNA VMware Workstation Fixed in 17.5.1
- Fix · CNA VMware Fusion Fixed in 13.5.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware ESXi ESXi70U3p-23307199, ESXi80U1d-23299997, ESXi80U2sb-23305545
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-14840 Use-after-free in VMware ESXiPriority MEDIUM 48
- TI-2024-14842 Out-of-bounds write in VMware ESXiPriority LOW 38
- TI-2024-14843 Information disclosure in VMware ESXiPriority LOW 36
- Release ·
VMware Fusion, VMware Workstation 13.5.1, 17.5.1
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-14840 Use-after-free in VMware ESXiPriority MEDIUM 48
- TI-2024-14843 Information disclosure in VMware ESXiPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22253
- 2026-10-03 Alias added: GHSA-57rg-p28x-x2f6
- 2026-10-20 EPSS moved to the 50th–90th percentile
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22253 · CVE Program
- CVE-2024-22253 · NVD
- FIRST EPSS
- GHSA-57rg-p28x-x2f6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences