EUVD-2026-51106
GHSA-m337-3vqr-5pf8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Actor needs VM deployment rights so PR:H; guest-to-host crossing gives S:C; high info disclosure (C:H) and low host DoS (A:L), no integrity impact.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
Articles & Coverage 1
AnalysisAI
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an actor to already hold VM deployment/provisioning privileges (CVSS PR:H) - the attacker must be able to deploy or configure a virtual machine on the affected host or management plane; this is not exploitable by an unauthenticated external attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L): high privileges required (PR:H, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An actor with VM deployment privileges (for example a semi-trusted tenant admin or a compromised provisioning account) deploys or configures a VM whose emulated-device input triggers the out-of-bounds read in the host process. On ESX this crashes or leaks memory from the host VMX process, causing a Denial-of-Service or disclosing adjacent host memory; on Workstation and Fusion the result is limited to information disclosure. … |
| Remediation | Apply the fixed builds published in the Broadcom/VMware security advisory (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) for each affected product line; exact fix versions are not included in the supplied data and must be taken from that advisory (Patch available per vendor advisory - released patched version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, catalog all VMware ESX, Workstation, and Fusion instances and audit which accounts hold VM deployment privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Foundation
View allVMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. Rated h
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today