CVE-2024-22267

—

CVSS 3.1

8.2 high

EPSS

<1%p50

Published

May 14, 2024 (May 14, 2024)

Modified

Jun 17, 2026

Description

VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Vendors: vmware
Products: fusion, workstation
Weakness: CWE-416
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news2 stories

VMware Patches Severe Security Flaws in Workstation and Fusion Products

The Hacker NewsMay 15, 00:00 UTC · May 15, 2024Vulnerability CVE-2024-22267 CVE-2024-22268 CVE-2024-22269+3 CVEs

VMware fixed zero

Security AffairsMay 14, 18:04 UTC · May 14, 2024Exploit / PoC CVE-2024-22267 CVE-2024-22268 CVE-2024-22269+1 CVEs