CVE-2009-3732: VMware Ace

High severity, CVSS 10.0. EPSS: 16.2% chance of exploitation in the next 30 days.

Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

• VMware Ace: from 2.5.0, before 2.5.4 (fixed in 2.5.4); version 2.6 only
• VMware Player: from 2.5.0, before 2.5.4 (fixed in 2.5.4); version 3.0 only
• VMware Server: from 2.0.0, up to and including 2.0.2
• VMware Workstation: from 6.5.0, before 6.5.4 (fixed in 6.5.4); version 7.0 only

Published 2010-04-12. Last modified 2026-06-16.