Out-of-bounds read in VMware Workstation
Priority LOW 31CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Workstation, this issue in conjunction with other bugs may allow a guest to leak information from host or may allow for a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this issue in conjunction with other bugs may allow a View desktop to leak information from host or may allow for a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Why it matters now
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed Workstation (VMware): 14.1.0Horizon Client for Windows (VMware): 4.7.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Workstation | 14 to before 14.1.0; 12.x | 14.1.0 | Patch available | CNA |
| VMware | Horizon Client for Windows | 4 to before 4.7.0 | 4.7.0 | Patch available | CNA |
- Workstation VendorVMware Affected 14 to before 14.1.0; 12.x Fixed in 14.1.0 Patch available CNA
- Horizon Client for Windows VendorVMware Affected 4 to before 4.7.0 Fixed in 4.7.0 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:workstation:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:* | 12.0.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:* | 12.1.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:* | 12.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.0:*:*:*:*:*:*:* | 12.5.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:* | 12.5.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:* | 12.5.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.3:*:*:*:*:*:*:* | 12.5.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.4:*:*:*:*:*:*:* | 12.5.4 | Vulnerable | VMware |
- cpe:2.3:a:vmware:workstation:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:* Versions 12.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:* Versions 12.5.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.3:*:*:*:*:*:*:* Versions 12.5.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.4:*:*:*:*:*:*:* Versions 12.5.4 Vulnerable ·VMware
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:workstation:12.5.5:*:*:*:*:*:*:* | 12.5.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.6:*:*:*:*:*:*:* | 12.5.6 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.7:*:*:*:*:*:*:* | 12.5.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.8:*:*:*:*:*:*:* | 12.5.8 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:12.5.9:*:*:*:*:*:*:* | 12.5.9 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:horizon_view:*:*:*:*:*:*:*:* | 4.0 to before 4.7 | Vulnerable | VMware |
- cpe:2.3:a:vmware:workstation:12.5.5:*:*:*:*:*:*:* Versions 12.5.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.6:*:*:*:*:*:*:* Versions 12.5.6 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.7:*:*:*:*:*:*:* Versions 12.5.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.8:*:*:*:*:*:*:* Versions 12.5.8 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:12.5.9:*:*:*:*:*:*:* Versions 12.5.9 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:horizon_view:*:*:*:*:*:*:*:* Versions 4.0 to before 4.7 Vulnerable ·VMware
Remediation
- Fix · CNA Workstation (VMware) Fixed in 14.1.0
- Fix · CNA Horizon Client for Windows (VMware) Fixed in 4.7.0
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4948
- 2026-10-03 Alias added: GHSA-2436-v72x-5q8x
References
More VMware Horizon View vulnerabilities
- TI-2017-03050 Command injection in VMware Horizon View Client for Mac CVSS 3.0CRITICAL 9.8
- TI-2017-03039 Memory corruption in VMware Unified Access Gateway CVSS 3.0CRITICAL 9.8
- TI-2017-03069 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03068 Out-of-bounds read in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03067 Out-of-bounds write in VMware Workstation CVSS 3.0HIGH 7.8
- TI-2017-03045 Integer overflow in VMware Workstation CVSS 3.0HIGH 7.8
Sources
- CVE-2017-4948 · CVE Program
- CVE-2017-4948 · NVD
- FIRST EPSS
- GHSA-2436-v72x-5q8x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences