What’s Vulnerable › Vulnerabilities

CVE-2024-22267

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-416

Description

VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Affected products

• VMware Fusion: from 13.0.0 before 13.5.2 — fixed in 13.5.2
• VMware Workstation: from 17.0.0 before 17.5.2 — fixed in 17.5.2
• VMware Fusion: from 13.0.0 before 13.5.2 — fixed in 13.5.2
• Vmware Workstation: from 17.0 before 17.5.2 — fixed in 17.5.2
• VMware Fusion: from 13.x before 13.5.2 — fixed in 13.5.2
• VMware Workstation: from 17.x before 17.5.2 — fixed in 17.5.2

How to fix

Upgrade to a fixed version: VMware Fusion 13.5.2; VMware Workstation 17.5.2; VMware Fusion 13.5.2; Vmware Workstation 17.5.2; VMware Fusion 13.5.2; VMware Workstation 17.5.2. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

Get alerted when CVE-2024-22267 or the next vulnerability affects your stack