VMware Workstation Pro vulnerabilities

27 CVEs affecting VMware Workstation Pro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22040, published 2022-02-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5330, published 2016-08-08. High severity, CVSS 7.8. EPSS: 18% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation…
CVE-2017-4915, published 2017-05-22. High severity, CVSS 7.8. EPSS: 5.4% chance of exploitation in the next 30 days. VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to…
CVE-2017-4916, published 2017-05-22. Medium severity, CVSS 6.5. EPSS: 5% chance of exploitation in the next 30 days. VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user…
CVE-2017-4933, published 2017-12-20. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap…
CVE-2018-6957, published 2018-03-15. Medium severity, CVSS 5.3. EPSS: 1.6% chance of exploitation in the next 30 days. VMware Workstation (14.x before 14.1.1, 12.x) and Fusion (10.x before 10.1.1 and 8.x) contain a denial-of-service vulnerability which can be triggered by opening a large number of VNC sessions. Note:…
CVE-2016-7084, published 2016-12-29. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allows guest OS users to…
CVE-2016-7083, published 2016-12-29. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary…
CVE-2017-4905, published 2017-06-07. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch…
CVE-2021-22040, published 2022-02-16. Medium severity, CVSS 6.7. EPSS: 0.7% chance of exploitation in the next 30 days. VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this…
CVE-2017-4924, published 2017-09-15. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds write vulnerability in SVGA device. This issue may…

Latest

CVE-2020-3990, published 2020-09-16. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in Cortado ThinPrint component. A…
CVE-2020-3989, published 2020-09-16. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-bounds write issue in Cortado ThinPrint component. A malicious…
CVE-2020-3988, published 2020-09-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal…
CVE-2020-3987, published 2020-09-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor…
CVE-2020-3986, published 2020-09-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMF Parser). A malicious actor with normal…
CVE-2017-4925, published 2017-09-15. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x before 12.5.3), Fusion (8.x before…