CVE-2018-6957

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-15 · updated 2026-06-17
Weakness: CWE-772

Description

VMware Workstation (14.x before 14.1.1, 12.x) and Fusion (10.x before 10.1.1 and 8.x) contain a denial-of-service vulnerability which can be triggered by opening a large number of VNC sessions. Note: In order for exploitation to be possible on Workstation and Fusion, VNC must be manually enabled.

Affected products

VMware Fusion: from 10.0 before 10.1.1; 8.0, 8.0.1, 8.0.2, 8.1, 8.1.1, 8.5 (+8) — fixed in 10.1.1
VMware Workstation Player: from 14.0 before 14.1.1; 12.0, 12.0.1, 12.1, 12.1.1, 12.5, 12.5.1 (+6) — fixed in 14.1.1
VMware Workstation Pro: from 14.0 before 14.1.1; 12.0, 12.1, 12.01, 12.1.1, 12.5, 12.5.1 (+6) — fixed in 14.1.1
VMware Fusion: 10.x before 10.1.1, 8.x
VMware Workstation: 14.x before 14.1.1, 12.x

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.1; VMware Workstation Player 14.1.1; VMware Workstation Pro 14.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-6957 or the next vulnerability affects your stack