TI-2024-14857 Aliases CVE-2024-22270 GHSA-455v-w5mm-7hf6

Information disclosure in VMware Workstation

LOW 32CWE-200Published 2024-05-14 · Updated 2024-08-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0052 44th percentileScored 2026-11-07

Fix Fixed VMware Workstation (N/A): 17.5.2VMware Fusion (N/A): 13.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
N/A	VMware Workstation	17.x to before 17.5.2	17.5.2	Patch available	CNA
N/A	VMware Fusion	13.x to before 13.5.2	13.5.2	Patch available	CNA

VMware Workstation VendorN/A Affected 17.x to before 17.5.2 Fixed in 17.5.2 Patch available CNA
VMware Fusion VendorN/A Affected 13.x to before 13.5.2 Fixed in 13.5.2 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:workstation::::::::	17.0.0 to before 17.5.2	Vulnerable	VMware
cpe:2.3:a:vmware:fusion::::::::	13.0.0 to before 13.5.2	Vulnerable	VMware
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple

cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 17.0.0 to before 17.5.2 Vulnerable ·VMware
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 13.0.0 to before 13.5.2 Vulnerable ·VMware
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

Fix · CNA VMware Workstation (N/A) Fixed in 17.5.2
Fix · CNA VMware Fusion (N/A) Fixed in 13.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-05-14
VMware Fusion 13.5.2
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-14854 Use after free in NA VMware WorkstationPriority MEDIUM 43
- TI-2024-14856 Information disclosure in VMware WorkstationPriority LOW 32
- TI-2024-14855 Out-of-bounds write in VMware WorkstationPriority LOW 32
Show all 4 records →
Release · 2024-05-14
VMware Workstation 17.5.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2024-14856 Information disclosure in VMware WorkstationPriority LOW 32
- TI-2024-14855 Out-of-bounds write in VMware WorkstationPriority LOW 32
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-22270
2026-10-03 Alias added: GHSA-455v-w5mm-7hf6

References

Advisory 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences