VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws

VMware released patches addressing four vulnerabilities affecting ESXi, Workstation, and Fusion — notably two critical XHCI USB controller use-after-free flaws (CVE-2024-22252, CVE-2024-22253) that can allow a local attacker in a VM to execute code in the host VMX process; additional issues include an out-of-bounds write (CVE-2024-22254) and an information disclosure in UHCI (CVE-2024-22255). Patches and affected version information are provided, and VMware recommends removing USB controllers from VMs as a temporary mitigation.