CyberzSOC

The most serious bugs could allow a malicious actor with local admin privileges on a virtual machine to execute code as the virtual machine’s VMX process running on the host. It is recommended upgrading affected software as soon as possible. The vulnerabilities CVE-2024-22252 and CVE-2024-22253, both with a CVSS score of 9.3 Workstation/Fusion and of 8.4 for ESXi, are Use-after-free vulnerability in XHCI USB controller and in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation The vulnerability CVE-2024-22254, with a CVSS score of 7.9, is an out-of-bounds write vulnerability in ESXi.