Read the docs
TI-2017-03044 Aliases CVE-2017-4912GHSA-4cr9-chr7-w4pj

Out-of-bounds read in VMware Workstation

Priority LOW 34CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in TrueType Font (TTF) parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.

Why it matters now

EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed Workstation (VMware): 12.5.3Horizon View Client for Windows (VMware): 4.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareWorkstation12 to before 12.5.312.5.3Patch availableCNA
VMwareHorizon View Client for Windows4 to before 4.4.04.4.0Patch availableCNA
  • Workstation VendorVMware Affected 12 to before 12.5.3 Fixed in 12.5.3 Patch available CNA
  • Horizon View Client for Windows VendorVMware Affected 4 to before 4.4.0 Fixed in 4.4.0 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:vmware:horizon_view:4.0:*:*:*:*:*:*:*4.0VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.1:*:*:*:*:*:*:*4.1VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.2:*:*:*:*:*:*:*4.2VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.3:*:*:*:*:*:*:*4.3VulnerableVMware
cpe:2.3:a:vmware:workstation:12.0:*:*:*:*:*:*:*12.0VulnerableVMware
cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:*12.0.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:*12.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:*12.5VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:*12.5.1VulnerableVMware
  • cpe:2.3:a:vmware:horizon_view:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:* Versions 12.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:* Versions 12.5.1 Vulnerable ·VMware
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:*12.5.2VulnerableVMware
  • cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·VMware

Remediation

  • Fix · CNA Workstation (VMware) Fixed in 12.5.3
  • Fix · CNA Horizon View Client for Windows (VMware) Fixed in 4.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-4912
  2. 2026-10-03 Alias added: GHSA-4cr9-chr7-w4pj

References

Advisory 1

  • TI-2017-03050 Command injection in VMware Horizon View Client for Mac CVSS 3.0CRITICAL 9.8
  • TI-2017-03039 Memory corruption in VMware Unified Access Gateway CVSS 3.0CRITICAL 9.8
  • TI-2017-03069 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03068 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03067 Out-of-bounds write in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03045 Integer overflow in VMware Workstation CVSS 3.0HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences