VMware Workstation vulnerabilities

17 CVEs affecting VMware Workstation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59347, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0177, published 2009-01-20. Medium severity, CVSS 5.0. EPSS: 8.6% chance of exploitation in the next 30 days. vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware Workstation 6.5.1 build 126130, 6.5.1 and earlier; VMware Player 2.5.1 build 126130, 2.5.1 and earlier; VMware…
CVE-2007-0062, published 2007-09-21. High severity, CVSS 10.0. EPSS: 7.6% chance of exploitation in the next 30 days. Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before…
CVE-2008-1392, published 2008-03-20. High severity, CVSS 10.0. EPSS: 2.7% chance of exploitation in the next 30 days. The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API…
CVE-2008-1364, published 2008-03-20. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x before 1.0.5, VMware Server 1.0.x before 1.0.5, and VMware…
CVE-2008-1340, published 2008-03-20. High severity, CVSS 7.1. EPSS: 1.7% chance of exploitation in the next 30 days. Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 allows attackers to cause a denial of…
CVE-2008-3761, published 2008-08-21. Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days. hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745…
CVE-2008-0923, published 2008-02-26. Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write…
CVE-2008-2098, published 2008-06-02. Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the VMware Host Guest File System (HGFS) in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, VMware ACE 2 before 2.0.2 build…
CVE-2008-2099, published 2008-06-02. Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in VMCI in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, and VMware ACE 2 before 2.0.2 build 93057 on Windows allows guest OS…
CVE-2007-5671, published 2008-06-05. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build…

Latest

CVE-2026-59347, published 2026-10-07. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to…
CVE-2026-59346, published 2026-10-07. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit…
CVE-2008-4916, published 2009-04-06. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Unspecified vulnerability in a guest virtual device driver in VMware Workstation before 5.5.9 build 126128, and 6.5.1 and earlier 6.x versions; VMware Player before 1.0.9 build 126128, and 2.5.1 and…
CVE-2008-0967, published 2008-06-05. Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days. Untrusted search path vulnerability in vmware-authd in VMware Workstation 5.x before 5.5.7 build 91707 and 6.x before 6.0.4 build 93057, VMware Player 1.x before 1.0.7 build 91707 and 2.x before…