CVE-2026-22722 MEDIUM

CVE-2026-22722: VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash

Vendor Vmware
Product Workstation
Weakness CWE-476
Published February 26, 2026
Last update February 27, 2026
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference error. To Remediate CVE-2026-22722, apply the patches listed in the "Fixed version" column of the 'Response Matrix'

Key dates

02Disclosure timeline

February 26, 2026 CVE published
February 27, 2026 Record updated