ZDI-CAN-23490: ZDI-24-494: VMware Workstation SVGA Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published May 22, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workstation. User interaction is required to exploit this vulnerability in that the target in a guest system must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 9.6. The following CVEs are assigned: CVE-2024-22268.

Affected Software

1 affected component

VMware Workstation

Event History

May 22, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-23490?

The severity of ZDI-CAN-23490 is considered high due to the potential for remote code execution.

How can I fix ZDI-CAN-23490?

To fix ZDI-CAN-23490, update your VMware Workstation to the latest version provided by VMware.

Who is affected by ZDI-CAN-23490?

Users of VMware Workstation are the ones affected by ZDI-CAN-23490.

What causes ZDI-CAN-23490?

ZDI-CAN-23490 is caused by improper handling of user input in VMware Workstation.

Is user interaction required to exploit ZDI-CAN-23490?

Yes, user interaction is required as the target must visit a malicious page or open a malicious file.