Out-of-bounds write in VMware ESXi
Priority LOW 38CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix Fixed VMware ESXi: ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware ESXi | 8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199 | ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 | Patch available | CNA |
| — | VMware Cloud Foundation | 5.x; 4.x | — | No fix listed | CNA |
- VMware ESXi Vendor— Affected 8.0 to before ESXi80U2sb-23305545; 8.0 to before ESXi80U1d-23299997; 7.0 to before ESXi70U3p-23307199 Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 Patch available CNA
- VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 4.0 – 5.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* | 7.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* | 7.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* | 7.0 update_1b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* | 7.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* | 7.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* | 7.0 update_1e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* | 7.0 update_2 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* | 7.0 update_2a | Vulnerable | VMware |
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 – 5.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* | 7.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* | 7.0 update_2d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* | 7.0 update_2e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* | 7.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* | 7.0 update_3c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* | 7.0 update_3d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* | 7.0 update_3e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* | 7.0 update_3f | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* | 7.0 update_3g | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* | 7.0 update_3i | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* | 7.0 update_3j | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* | 7.0 update_3k | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* | 7.0 update_3l | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* | 7.0 update_3m | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* | 7.0 update_3n | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* | 7.0 update_3o | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:* | 7.0.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* | 8.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* | 8.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* | 8.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* | 8.0 update_2 | Vulnerable | VMware |
- cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* Versions 7.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* Versions 7.0 update_3i Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* Versions 7.0 update_3j Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* Versions 7.0 update_3k Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* Versions 7.0 update_3l Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* Versions 7.0 update_3m Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* Versions 7.0 update_3n Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* Versions 7.0 update_3o Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0.0:b:*:*:*:*:*:* Versions 7.0.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
Remediation
- Fix · CNA VMware ESXi Fixed in ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware ESXi ESXi70U3p-23307199, ESXi80U1d-23299997, ESXi80U2sb-23305545
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-14840 Use-after-free in VMware ESXiPriority MEDIUM 48
- TI-2024-14841 Use-after-free in VMware ESXiPriority MEDIUM 43
- TI-2024-14843 Information disclosure in VMware ESXiPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22254
- 2026-10-03 Alias added: GHSA-mw76-72hw-4357
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-22254 · CVE Program
- CVE-2024-22254 · NVD
- FIRST EPSS
- GHSA-mw76-72hw-4357 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences