Login Request a demo
High severity · published Nov 17, 2017
CVE-2017-4939
VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue that exists due to some DLL files loaded by the application improperly
7.8
CVSS
1.3%
EPSS
No
On KEV
Description
VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue that exists due to some DLL files loaded by the application improperly. This issue may allow an attacker to load a DLL file of the attacker's choosing that could execute arbitrary code.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Workstation · Vmware
12.0.0; 12.0.1; 12.1.1; 12.5.0; 12.5.1; 12.5.2; +5 more · source: NVD
Affected product
WO
Workstation
Vmware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-4939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-4939
Third Party Advisory
http://www.securityfocus.com/bid/101890
Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2017-0018.html
More from Workstation
8.2
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
6.0
CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
9.9
CVE-2017-4901
The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability
9.8
CVE-2016-2077
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host OS users to gain host OS privileges…
9.8
CVE-2010-1205
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG…