CVE-2026-22717: VMware Workstation Info Disclosure Flaw

CVE-2026-22717 Overview

CVE-2026-22717 is an out-of-bounds read vulnerability affecting VMware Workstation versions 25H1 and earlier across all supported platforms. This memory corruption flaw allows an attacker with non-administrative privileges on a guest virtual machine to access memory beyond intended boundaries, potentially leading to limited information disclosure from the host machine where VMware Workstation is installed.

Critical Impact

Guest VM users without administrative privileges can potentially extract sensitive information from the host machine through memory disclosure, compromising the isolation boundary between guest and host systems.

Affected Products

• VMware Workstation 25H1 and earlier versions
• All platforms supported by VMware Workstation

Discovery Timeline

• 2026-02-27 - CVE-2026-22717 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-22717

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue where the application reads data past the end or before the beginning of an intended buffer. In virtualization software like VMware Workstation, such vulnerabilities are particularly concerning because they can potentially breach the critical security boundary between guest virtual machines and the host operating system.

The attack requires local access and specific conditions to be met, including user interaction, making exploitation more complex. However, the cross-scope impact means that a successful attack originating from within a guest VM can affect the host system's confidentiality, which is a fundamental violation of virtualization security principles.

Root Cause

The vulnerability stems from improper bounds checking when processing certain operations within VMware Workstation. When the affected code path reads memory, it fails to properly validate that the read operation stays within the allocated buffer boundaries. This allows an attacker to craft inputs that cause the application to read beyond the intended memory region, potentially exposing sensitive data from adjacent memory locations.

Attack Vector

The attack requires local access from within a guest virtual machine. An attacker with non-administrative privileges on the guest OS can potentially trigger the out-of-bounds read condition through specific operations that interact with the vulnerable component. While the attack complexity is high and requires user interaction, successful exploitation could result in disclosure of information from the host system's memory.

The attack flow involves:

1. Attacker gains access to a guest VM (no admin privileges required)
2. Specific conditions are crafted to trigger the vulnerable code path
3. Memory beyond intended boundaries is read
4. Limited host system information may be disclosed to the attacker

Detection Methods for CVE-2026-22717

Indicators of Compromise

• Unusual memory access patterns from VMware Workstation processes
• Unexpected error messages or crashes in VMware components related to memory operations
• Anomalous guest-to-host communication patterns

Detection Strategies

• Monitor VMware Workstation processes for abnormal memory access behaviors
• Implement endpoint detection rules to identify potential out-of-bounds read exploitation attempts
• Review VMware log files for unexpected errors or memory-related warnings

Monitoring Recommendations

• Enable verbose logging in VMware Workstation to capture detailed operational data
• Deploy memory protection mechanisms that can detect out-of-bounds access attempts
• Utilize SentinelOne's behavioral AI to identify anomalous virtualization software behavior

How to Mitigate CVE-2026-22717

Immediate Actions Required

• Review the Broadcom Security Advisory #36986 for official guidance
• Inventory all VMware Workstation installations in your environment and identify versions at or below 25H1
• Limit access to guest VMs to trusted users only until patches are applied

Patch Information

VMware has addressed this vulnerability through a security update. Organizations should consult the Broadcom Security Advisory #36986 for detailed patch information and update instructions. Apply the latest security patches for VMware Workstation to remediate this vulnerability.

Workarounds

• Restrict guest VM access to only trusted users with legitimate business needs
• Implement network segmentation to limit potential information disclosure impact
• Consider disabling or limiting shared features between guest and host systems where possible
• Deploy additional endpoint monitoring on systems running VMware Workstation