VMware ESXi, Workstation, and Fusion TOCTOU Vulnerability Leading to Out-of-Bounds Write

A TOCTOU (Time-of-Check Time-of-Use) vulnerability allowing an out-of-bounds write has been identified in VMware ESXi, Workstation, and Fusion. This vulnerability can be exploited by a malicious actor with local administrative privileges on a virtual machine to execute code as the VM's VMX process on the host.

Impact

Exploitation of this vulnerability allows for unauthorized code execution within the context of the virtual machine's VMX process on the host.

Remediation

Users can apply the patches available in the VMware Product Response Matrix. For VMware ESXi, Workstation, and Fusion, the specific patch versions are listed in the 'Fixed Version' column of the Response Matrix. Additional guidance can be found in the VMware Patching Guide: KB88287.