CVE-2024-22268: VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A mali

Routine

HIGH 7.1UPGRADEUPGRADE

CVE-2024-22268 is a high-severity flaw (CVSS 7.1) affecting workstation, fusion. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial of service condition.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.1 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 59%)
CISA exploited list	No
Weakness	CWE-787
Published	2024-05-14
Last modified	2026-06-17

Publisher (CNA): VMware · Vendor: vmware

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-05-14 16:16 UTCPublished CVE record published
2026-06-17 07:11 UTCUpdated Record last modified

vmware workstation UPGRADE

Affected: >= 17.0.0 and < 17.5.2

Fixed in: 17.5.2

Safe to downgrade to: a release before 17.0.0

1. Check installed version

apt-cache policy workstation || rpm -q workstation || workstation --version

2. UPGRADE to 17.5.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade workstation

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade workstation

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 17.0.0 (Debian / Ubuntu)

apt-cache madison workstation sudo apt install workstation=<VERSION_BEFORE_17.0.0> sudo apt-mark hold workstation

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list workstation sudo dnf downgrade workstation-<VERSION_BEFORE_17.0.0> sudo dnf versionlock add workstation

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

vmware fusion UPGRADE

Affected: >= 13.0.0 and < 13.5.2

Fixed in: 13.5.2

Safe to downgrade to: a release before 13.0.0

1. Check installed version

apt-cache policy fusion || rpm -q fusion || fusion --version

2. UPGRADE to 13.5.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade fusion

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade fusion

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 13.0.0 (Debian / Ubuntu)

apt-cache madison fusion sudo apt install fusion=<VERSION_BEFORE_13.0.0> sudo apt-mark hold fusion

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fusion sudo dnf downgrade fusion-<VERSION_BEFORE_13.0.0> sudo dnf versionlock add fusion

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-22268?

workstation: upgrade to 17.5.2; fusion: upgrade to 13.5.2. Exact commands for each OS are on this page.

Is CVE-2024-22268 being exploited?

CVE-2024-22268 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-22268 affect?

CVE-2024-22268 affects workstation, fusion. Severity is high (CVSS 7.1). VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability

How urgent is CVE-2024-22268?

Priority 35/100. High severity

Software pages

VMware vulnerabilities

Related CVEs

CVE-2025-22226 HIGH 7.1 EXPLOITED MITIGATE MITIGATE VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
CVE-2025-22224 CRITICAL 9.3 EXPLOITED MITIGATE MITIGATE VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2024-22273 HIGH 8.1 UPGRADE UPGRADE The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A
CVE-2024-22270 HIGH 7.1 UPGRADE UPGRADE VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (
CVE-2024-22269 HIGH 7.1 UPGRADE UPGRADE VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A mali

References

← Back to latest CVEs