TI-2026-18243 Aliases CVE-2026-22716 GHSA-jm5v-cr99-76mr

VMware Workstation out-of-bounds write vulnerability

LOW 22CWE-787Published 2026-02-27 · Updated 2026-02-27

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to terminate certain Workstation processes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00181 7th percentileScored 2026-11-07

Fix Fixed Workstation (VMware): 25H2U1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Workstation	25H2 to before 25H2U1	25H2U1	Patch available	CNA

Workstation VendorVMware Affected 25H2 to before 25H2U1 Fixed in 25H2U1 Patch available CNA

Remediation

Fix · CNA Workstation (VMware) Fixed in 25H2U1

Timeline

2026-10-02 Threatist record created from CVE-2026-22716
2026-10-03 Alias added: GHSA-jm5v-cr99-76mr

References

Other 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences