vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-22254

Out-of-bounds write vulnerability

HIGH
8.2
CVSS Score
Published: March 5, 2024 at 05:58 PM UTC
Updated: June 17, 2026 at 07:11 AM UTC
4 products affected across 2 vendorsCloud FoundationESXiCloud Foundation

Using VMware ESXi by N/A?

Get instant alerts when new vulnerabilities affect VMware ESXi - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.2
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Cloud Foundation· VMware
95%
4.0 ≤ v ≤ 5.04.x5.x
ESXi· VMware
95%
7.0 ≤ v < ESXi70U3p-233071998.0 ≤ v < ESXi80U1d-232999978.0 ≤ v < ESXi80U2sb-233055457.07.0 update_17.0 update_1a7.0 update_1b7.0 update_1c7.0 update_1d7.0 update_1e7.0 update_27.0 update_2a7.0 update_2c7.0 update_2d7.0 update_2e7.0 update_37.0 update_3c7.0 update_3d7.0 update_3e7.0 update_3f7.0 update_3g7.0 update_3i7.0 update_3j7.0 update_3k7.0 update_3l7.0 update_3m7.0 update_3n7.0 update_3o7.0.0 b8.08.0 a8.0 b8.0 c8.0 update_18.0 update_1a8.0 update_1c8.0 update_2
Affected range stops below ESXi70U3p-23307199, so it looks safe — our inference, not a vendor statement
Affected range stops below ESXi80U1d-23299997, so it looks safe — our inference, not a vendor statement
Affected range stops below ESXi80U2sb-23305545, so it looks safe — our inference, not a vendor statement
Cloud Foundation· Broadcom
60%
4.05.0
VMware Esxi· VMware
60%
7.0 ≤ v < ESXi70U3p-233071998.0 ≤ v < ESXi80U1d-232999978.0 ≤ v < ESXi80U2sb-233055457.08.0
Affected range stops below ESXi70U3p-23307199, so it looks safe — our inference, not a vendor statement
Affected range stops below ESXi80U1d-23299997, so it looks safe — our inference, not a vendor statement
Affected range stops below ESXi80U2sb-23305545, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Vendor Advisory
Source: [email protected]
https://www.vmware.com/security/advisories/VMSA-2024-0006.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.2HIGH[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card