Command injection in VMware Horizon View Client for Mac
Priority MEDIUM 50CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.
Why it matters now
EPSS 0.04859 92nd percentileScored 2026-11-07
Fix Fixed Horizon View Client for Mac (VMware): 4.5.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Horizon View Client for Mac | 2.x; 3.x; 4 to before 4.5.0 | 4.5.0 | Patch available | CNA |
- Horizon View Client for Mac VendorVMware Affected 2.x; 3.x; 4 to before 4.5.0 Fixed in 4.5.0 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:horizon_view:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:2.3:*:*:*:*:*:*:* | 2.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:3.3:*:*:*:*:*:*:* | 3.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | VMware |
- cpe:2.3:a:vmware:horizon_view:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·VMware
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:horizon_view:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:4.3.0:*:*:*:*:*:*:* | 4.3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:4.4.0:*:*:*:*:*:*:* | 4.4.0 | Vulnerable | VMware |
- cpe:2.3:a:vmware:horizon_view:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·VMware
Remediation
- Fix · CNA Horizon View Client for Mac (VMware) Fixed in 4.5.0
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4918
- 2026-10-03 Alias added: GHSA-qr5w-hhfh-gp9g
References
More VMware Horizon View vulnerabilities
- TI-2017-03039 Memory corruption in VMware Unified Access Gateway CVSS 3.0CRITICAL 9.8
- TI-2017-03069 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03068 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03067 Out-of-bounds write in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03045 Integer overflow in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03044 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
Sources
- CVE-2017-4918 · CVE Program
- CVE-2017-4918 · NVD
- FIRST EPSS
- GHSA-qr5w-hhfh-gp9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences