CVE-2024-22253

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	VMware ESXi	>= 8.0, < ESXi80U2sb-23305545; >= 8.0, < ESXi80U1d-23299997; >= 7.0, < ESXi70U3p-23307199
n/a	VMware Workstation	>= 17.x, < 17.5.1
n/a	VMware Fusion	>= 13.x, < 13.5.1
n/a	VMware Cloud Foundation	5.x; 4.x
vmware	esxi	>= 8.0, < esxi80U2sb-23305545; >= 8.0, < esxi80U1d-23299997; >= 7.0, < esxi70U3p-23307199
vmware	vmware_workstation	>= 17.0, < 17.5.1
vmware	fusion	>= 13.0, < 13.5.1
vmware	cloud_foundation	>= 4.0, < 6.0

References

https://www.vmware.com/security/advisories/VMSA-2024-0006.htmlVendor Advisory
https://www.vmware.com/security/advisories/VMSA-2024-0006.htmlVendor Advisory

Timeline

Published: Mar 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-222548.2VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bo CVE-2024-222557.1VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with admi CVE-2024-222564.3VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about or CVE-2024-222578.2In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, v CVE-2024-222586.1Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Do CVE-2024-222598.1Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perf CVE-2024-22265.4The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti CVE-2024-222606.8VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One CVE-2024-222615.5SQL-Injection in Harbor allows priviledge users to leak the task IDs CVE-2024-222628.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation check CVE-2024-222638.8Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has CVE-2024-222647.2VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer