NetSight
IP …
high7.8

CVE-2021-22045

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-…

Impact

VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

Affected products

VendorProductAffected versions
VmwareCloud Foundation
from 3.0 through 3.10.2.2
from 4.0 through 4.3.1
VmwareWorkstation
from 16.0.0 before 16.2.0
VmwareFusion
from 12.0.0 before 12.2.0
VmwareEsxi
Versions 6.5, 6.7, 7.0

Weakness classification

CWE-787

References