CVE-2022-22938

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-28 · updated 2026-06-17

Description

VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.

Affected products

VMware Horizon Agent for Linux: from 5.0.0 before 5.5.3 — fixed in 5.5.3
VMware Workstation: from 16.0.0 before 16.2.2 — fixed in 16.2.2

How to fix

Upgrade to a fixed version: VMware Horizon Agent for Linux 5.5.3; VMware Workstation 16.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22938 or the next vulnerability affects your stack