What’s Vulnerable › Vulnerabilities

CVE-2018-6974

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-10-16 · updated 2026-06-17
• Weakness: CWE-125

Description

VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

Affected products

• VMware ESXi: 6.0-1, 6.0-1a, 6.0-1b, 6.0-2, 6.0-3, 6.0-3a (+114); 6.0, 6.5, 6.7
• VMware Fusion: from 10.0 before 10.1.3 — fixed in 10.1.3
• VMware Workstation: from 14.0 before 14.1.3 — fixed in 14.1.3
• VMware ESXi: 6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, 6.0 before ESXi600-201808401-BG
• VMware Fusion: 10.x before 10.1.3
• VMware Workstation: 14.x before 14.1.3

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.3; VMware Workstation 14.1.3. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/105660
• http://www.securitytracker.com/id/1041875
• http://www.securitytracker.com/id/1041876
• https://www.vmware.com/security/advisories/VMSA-2018-0026.html
• http://www.securityfocus.com/bid/105660
• http://www.securitytracker.com/id/1041875
• http://www.securitytracker.com/id/1041876
• https://www.vmware.com/security/advisories/VMSA-2018-0026.html

Get alerted when CVE-2018-6974 or the next vulnerability affects your stack