CVE-2018-6973

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-15 · updated 2026-06-17
Weakness: CWE-787

Description

VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device. This issue may allow a guest to execute code on the host.

Affected products

VMware Fusion: from 10.0.0 (excl.) before 10.1.3 — fixed in 10.1.3
VMware Workstation: from 14.0.0 before 14.1.3 — fixed in 14.1.3
VMware Fusion: 10.x before 10.1.3
VMware Workstation: 14.x before 14.1.3

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.3; VMware Workstation 14.1.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/105094
http://www.securitytracker.com/id/1041491
https://www.vmware.com/security/advisories/VMSA-2018-0022.html
http://www.securityfocus.com/bid/105094
http://www.securitytracker.com/id/1041491
https://www.vmware.com/security/advisories/VMSA-2018-0022.html

Get alerted when CVE-2018-6973 or the next vulnerability affects your stack