Information security specialists reported the finding of a critical vulnerability affecting VMware Workstation and VMware Fusion. According to the report, successful exploitation of these flaws would allow running arbitrary code on the affected systems.
Tracked as CVE-2021-22045, this flaw exists due to a boundary error on the affected applications, which would allow remote threat actors with access to the guest OS trigger a heap-based buffer overflow, thus running arbitrary code on VMware’s hypervisor.
This is a high severity vulnerability and received a 7.1/10 score according to the Common Vulnerability Scoring System (CVSS). Successful exploitation of this flaw would allow remote hackers to run arbitrary code on the affected systems.
According to the report, the vulnerability resides in the following products and versions:
- VMware Workstation: 16.0, 16.1.0, 16.1.1, 16.1.2
- VMware Fusion: before 12.2.0
Even though this vulnerability could be exploited by remote authenticated hackers using specially crafted files, information security specialists have no detected active exploitation attempts. Still, VMware recommends users of affected implementations update as soon as possible.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
