CVE-2018-6977

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-09 · updated 2026-06-17
Weakness: CWE-835

Description

VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming unresponsive.

Affected products

VMware ESXi: 6.0, 6.5, 6.7
VMware Fusion: from 10.0.0 through 10.1.5; from 11.0.0 through 11.0.2
VMware Workstation: from 14.0.0 through 14.1.5; from 15.0.0 through 15.0.2

References

http://www.securityfocus.com/bid/105549
http://www.securitytracker.com/id/1041821
http://www.securitytracker.com/id/1041822
https://www.vmware.com/security/advisories/VMSA-2018-0025.html
http://www.securityfocus.com/bid/105549
http://www.securitytracker.com/id/1041821
http://www.securitytracker.com/id/1041822
https://www.vmware.com/security/advisories/VMSA-2018-0025.html

Get alerted when CVE-2018-6977 or the next vulnerability affects your stack