Read the docs
TI-2017-03067 Aliases CVE-2017-4935GHSA-vhq3-56w6-j6mg

Out-of-bounds write in VMware Workstation

Priority LOW 34CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.

Why it matters now

EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed Workstation (VMware): 12.5.8Horizon View Client for Windows (VMware): 4.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareWorkstation12 to before 12.5.812.5.8Patch availableCNA
VMwareHorizon View Client for Windows4 to before 4.6.14.6.1Patch availableCNA
  • Workstation VendorVMware Affected 12 to before 12.5.8 Fixed in 12.5.8 Patch available CNA
  • Horizon View Client for Windows VendorVMware Affected 4 to before 4.6.1 Fixed in 4.6.1 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableVMware
cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:*12.0.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:*12.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:*12.5VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:*12.5.1VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:*12.5.2VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.3:*:*:*:*:*:*:*12.5.3VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.4:*:*:*:*:*:*:*12.5.4VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.5:*:*:*:*:*:*:*12.5.5VulnerableVMware
  • cpe:2.3:a:vmware:workstation:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:* Versions 12.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:* Versions 12.5.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.3:*:*:*:*:*:*:* Versions 12.5.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.4:*:*:*:*:*:*:* Versions 12.5.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.5:*:*:*:*:*:*:* Versions 12.5.5 Vulnerable ·VMware
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:12.5.6:*:*:*:*:*:*:*12.5.6VulnerableVMware
cpe:2.3:a:vmware:workstation:12.5.7:*:*:*:*:*:*:*12.5.7VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.0.0:*:*:*:*:windows:*:*4.0.0VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.0.1:*:*:*:*:windows:*:*4.0.1VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.1:*:*:*:*:windows:*:*4.1VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.2:*:*:*:*:windows:*:*4.2VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.3:*:*:*:*:windows:*:*4.3VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.4:*:*:*:*:windows:*:*4.4VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.5:*:*:*:*:windows:*:*4.5VulnerableVMware
cpe:2.3:a:vmware:horizon_view:4.6:*:*:*:*:windows:*:*4.6VulnerableVMware
  • cpe:2.3:a:vmware:workstation:12.5.6:*:*:*:*:*:*:* Versions 12.5.6 Vulnerable ·VMware
  • cpe:2.3:a:vmware:workstation:12.5.7:*:*:*:*:*:*:* Versions 12.5.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.0.0:*:*:*:*:windows:*:* Versions 4.0.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.0.1:*:*:*:*:windows:*:* Versions 4.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.1:*:*:*:*:windows:*:* Versions 4.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.2:*:*:*:*:windows:*:* Versions 4.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.3:*:*:*:*:windows:*:* Versions 4.3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.4:*:*:*:*:windows:*:* Versions 4.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.5:*:*:*:*:windows:*:* Versions 4.5 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_view:4.6:*:*:*:*:windows:*:* Versions 4.6 Vulnerable ·VMware

Remediation

  • Fix · CNA Workstation (VMware) Fixed in 12.5.8
  • Fix · CNA Horizon View Client for Windows (VMware) Fixed in 4.6.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-4935
  2. 2026-10-03 Alias added: GHSA-vhq3-56w6-j6mg

References

Patch 1

  • TI-2017-03050 Command injection in VMware Horizon View Client for Mac CVSS 3.0CRITICAL 9.8
  • TI-2017-03039 Memory corruption in VMware Unified Access Gateway CVSS 3.0CRITICAL 9.8
  • TI-2017-03069 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03068 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03045 Integer overflow in VMware Workstation CVSS 3.0HIGH 7.8
  • TI-2017-03044 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences