VMware issued patches for critical flaws in ESXi, Workstation, Fusion, and Cloud Foundation, with a focus on two use-after-free vulnerabilities in the XHCI USB controller (CVE-2024-22252, CVE-2024-22253) scoring 9.3 CVSS. These allow local admin privilege escalation and code execution on the host. An ESXi out-of-bounds write and an information disclosure vulnerability in the UHCI USB controller were also noted.