Vmware Esxi vulnerabilities

CVE-2025-22224 High · 8.2 KEV High · 52 CWE-367 Mar 4, 2025

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

CVE-2025-22225 High · 8.2 KEV High · 60 Ransomware CWE-787 Mar 4, 2025

VMware ESXi Arbitrary Write Vulnerability

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

CVE-2025-22226 Medium · 6.0 KEV High · 50 CWE-125 Mar 4, 2025

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

CVE-2024-37085 High · 7.2 KEV Urgent · 82 Public exploit Ransomware CWE-287 Jun 25, 2024

VMware ESXi Authentication Bypass Vulnerability

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

CVE-2023-29552 High · 7.5 KEV High · 59 Apr 25, 2023

Service Location Protocol (SLP) Denial-of-Service Vulnerability

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CVE-2022-21166 Medium · 5.5 CWE-459 Jun 15, 2022

Incomplete cleanup in specific special register write operations for some Intel(R)…

Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2022-21125 Medium · 5.5 CWE-459 Jun 15, 2022

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an...

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2022-21123 Medium · 5.5 CWE-459 Jun 15, 2022

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an...

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2020-3992 Critical · 9.8 KEV Urgent · 79 Public exploit Ransomware CWE-416 Oct 20, 2020

VMware ESXi OpenSLP Use-After-Free Vulnerability

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVE-2019-5544 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-787 Dec 6, 2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2010-3904 High · 7.8 KEV Urgent · 76 Public exploit CWE-1284 Dec 6, 2010

Linux Kernel Improper Input Validation Vulnerability

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.