Unscored severity · published Dec 31, 2004
CVE-2004-2515
Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or typical circumstances under which VMware would be running with privileges beyond those already available to the attackers, so this might not be a vulnerability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Workstation · Vmware
4.5.2_build_8848 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2515
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1320.html
www.osvdb.org
http://www.osvdb.org/12169
www.securityfocus.com
http://www.securityfocus.com/bid/11737
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18297
More from Workstation
8.2
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
6.0
CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
9.9
CVE-2017-4901
The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability
9.8
CVE-2016-2077
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host OS users to gain host OS privileges…
9.8
CVE-2010-1205
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG…