CVE-2022-22938: VMware Horizon

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.

Affected products

• VMware Horizon: from 5.0.0, before 5.5.3 (fixed in 5.5.3)
• VMware Workstation: from 16.0.0, before 16.2.2 (fixed in 16.2.2)

Published 2022-01-28. Last modified 2026-06-17.