CVE-2022-31681

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-07 · updated 2026-06-17
Weakness: CWE-476

Description

VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.

Affected products

VMware Cloud Foundation: from 4.2 before 4.3.1.1; 4.4, 4.4.1, 4.4.1.1 (and their updates) — fixed in 4.3.1.1
VMware ESXi: before 7.0; 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b, 7.0-update_1c, 7.0-update_1d (+9); 7.0 — fixed in 7.0
VMware ESXi: from VMware ESXi (7.0 prior through ESXi70U3sf-20036586, 6.7 prior to ESXi670-202210101-SG & 6.5 prior to ESXi650-202210101-SG)

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 4.3.1.1; VMware ESXi 7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-31681 or the next vulnerability affects your stack