What’s Vulnerable › Vulnerabilities

CVE-2024-22270

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-200

Description

VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

Affected products

• VMware Fusion: from 13.0.0 before 13.5.2 — fixed in 13.5.2
• VMware Workstation: from 17.0.0 before 17.5.2 — fixed in 17.5.2
• VMware Fusion: before 13.5.2 — fixed in 13.5.2
• VMware Workstation: before 17.5.2 — fixed in 17.5.2
• VMware Fusion: from 13.x before 13.5.2 — fixed in 13.5.2
• VMware Workstation: from 17.x before 17.5.2 — fixed in 17.5.2

How to fix

Upgrade to a fixed version: VMware Fusion 13.5.2; VMware Workstation 17.5.2; VMware Fusion 13.5.2; VMware Workstation 17.5.2; VMware Fusion 13.5.2; VMware Workstation 17.5.2. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

Get alerted when CVE-2024-22270 or the next vulnerability affects your stack