hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier…
Priority LOW 24CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.
Why it matters now
EPSS 0.00995 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3761
- 2026-10-03 Alias added: GHSA-cqgj-ggx7-phrm
References
Exploit 1
Advisory 1
Other 5
- 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues
- http://www.orange-bat.com/adv/2008/adv.08.17.txt
- ADV-2009-0944
- [security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues
- http://www.vmware.com/security/advisories/VMSA-2009-0005.html
More Vmware Workstation vulnerabilities
- TI-2007-00058 Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP… CVSS 2.0HIGH 10.0
- TI-2008-01339 The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3… CVSS 2.0HIGH 10.0
- TI-2008-01313 Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6… CVSS 2.0HIGH 7.8
- TI-2008-01289 Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3… CVSS 2.0HIGH 7.1
- TI-2009-00166 vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware… CVSS 2.0MEDIUM 5.0
- TI-2008-01311 VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before… CVSS 2.0HIGH 7.2
Sources
- CVE-2008-3761 · CVE Program
- CVE-2008-3761 · NVD
- FIRST EPSS
- GHSA-cqgj-ggx7-phrm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences