CVE-2024-37086: VMware Cloud Foundation

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.

Affected products

• VMware Cloud Foundation: from 4.0, before 5.2 (fixed in 5.2)
• VMware ESXi: version 7.0 only; version 8.0 only

Published 2024-06-25. Last modified 2026-06-17.