Integer overflow in VMware Workstation Pro / Player
Priority LOW 31CWE-190Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.
Summary
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
Why it matters now
EPSS 0.00381 32nd percentileScored 2026-11-07
Fix Fixed Workstation Pro / Player (VMware): 14.1.1, 12.5.9Fusion (VMware): 10.1.1, 8.5.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Workstation Pro / Player | 14 to before 14.1.1; 12 to before 12.5.9 | 14.1.1, 12.5.9 | Patch available | CNA |
| VMware | Fusion | 10 to before 10.1.1; 8 to before 8.5.10 | 10.1.1, 8.5.10 | Patch available | CNA |
- Workstation Pro / Player VendorVMware Affected 14 to before 14.1.1; 12 to before 12.5.9 Fixed in 14.1.1, 12.5.9 Patch available CNA
- Fusion VendorVMware Affected 10 to before 10.1.1; 8 to before 8.5.10 Fixed in 10.1.1, 8.5.10 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* | 8.0 to before 8.5.10; 10.0 to before 10.1.1 | Vulnerable | VMware |
| cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | 12.0 to before 12.5.9; 14.0 to before 14.1.1 | Vulnerable | VMware |
- cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 8.0 to before 8.5.10; 10.0 to before 10.1.1 Vulnerable ·VMware
- cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 12.0 to before 12.5.9; 14.0 to before 14.1.1 Vulnerable ·VMware
Remediation
- Fix · CNA Workstation Pro / Player (VMware) Fixed in 14.1.1, 12.5.9
- Fix · CNA Fusion (VMware) Fixed in 10.1.1, 8.5.10
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4950
- 2026-10-03 Alias added: GHSA-72cc-6qc5-x46j
References
More VMware Fusion vulnerabilities
- TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
- TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
- TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
- TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
- TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
- TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3
Sources
- CVE-2017-4950 · CVE Program
- CVE-2017-4950 · NVD
- FIRST EPSS
- GHSA-72cc-6qc5-x46j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences