CVE-2017-4950
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
- CVSS 3.0
- 7.0 HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.38% probability · 32th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- vmware/fusion · vmware/workstation
- Source
- security@vmware.com
EPSS 0.4% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/102490Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040161Third Party Advisory, VDB Entry
- https://www.vmware.com/security/advisories/VMSA-2018-0005.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/102490Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040161Third Party Advisory, VDB Entry
- https://www.vmware.com/security/advisories/VMSA-2018-0005.htmlPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.