CVE-2026-22717

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-227186.8The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine.CVE-2026-227198.1VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitCVE-2026-22726.5A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and CVE-2026-227209.0VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks mCVE-2026-227217.2VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria OperationsCVE-2026-227226.1A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference errCVE-2026-227236.5Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78CVE-2026-227265.0Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a maliCVE-2026-227277.5Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows CVE-2026-227284.9Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives tCVE-2026-227298.6A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based acceCVE-2026-22738.2CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on th
CVE-2026-22717: Low severity, CVSS 2.7 | Vulnix