TI-2024-14854 Aliases CVE-2024-22267 GHSA-mcxh-3pw2-4rmg

Use after free in NA VMware Workstation

MEDIUM 43CWE-416Published 2024-05-14 · Updated 2025-03-14

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00704 53rd percentileScored 2026-11-07

Fix Fixed VMware Workstation (NA): 17.5.2VMware Fusion (N/A): 13.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NA	VMware Workstation	17.x to before 17.5.2	17.5.2	Patch available	CNA
N/A	VMware Fusion	13.x to before 13.5.2	13.5.2	Patch available	CNA

VMware Workstation VendorNA Affected 17.x to before 17.5.2 Fixed in 17.5.2 Patch available CNA
VMware Fusion VendorN/A Affected 13.x to before 13.5.2 Fixed in 13.5.2 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:fusion::::::::	13.0.0 to before 13.5.2	Vulnerable	VMware
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple
cpe:2.3:a:vmware:workstation::::::::	17.0.0 to before 17.5.2	Vulnerable	VMware

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 13.0.0 to before 13.5.2 Vulnerable ·VMware
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 17.0.0 to before 17.5.2 Vulnerable ·VMware

Remediation

Fix · CNA VMware Workstation (NA) Fixed in 17.5.2
Fix · CNA VMware Fusion (N/A) Fixed in 13.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-05-14
VMware Fusion 13.5.2
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-14857 Information disclosure in VMware WorkstationPriority LOW 32
- TI-2024-14856 Information disclosure in VMware WorkstationPriority LOW 32
- TI-2024-14855 Out-of-bounds write in VMware WorkstationPriority LOW 32
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-22267
2026-10-03 Alias added: GHSA-mcxh-3pw2-4rmg

References

Advisory 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences