vulnwire
7.8high

CVE-2016-70831 exploit

VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual print…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
1
Exploit-DB

VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memory corruption) via TrueType fonts embedded in EMFSPOOL.

Exploit prediction (EPSS)

1.50% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

Exploits and detections

  • EDB-40398 VMware Workstation - 'vprintproxy.exe' TrueType NAME Tables Heap Buffer Overflow (PoC) · dos · 2016-09-19

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD2.05.9AV:L/AC:M/Au:N/C:P/I:P/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • vmware.com /security/advisories/VMSA-2016-0014.html · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1036805 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exploit-db.com /exploits/40398/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/92934 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.