Tools (Vmware) - vulnerabilities (CVEs)

22 CVEs, 0 in the last 30 days, 122 known versions, newest CVE from 2025-09-29. Vendor: Vmware.

CVEs of Tools

• CVE-2025-41244 - CVSS 7.8 (high), 2025-09-29: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having…
• CVE-2025-41246 - CVSS 7.6 (high), 2025-09-29: VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with…
• CVE-2025-41239 - CVSS 7.1 (high), 2025-07-15: VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A…
• CVE-2023-34057 - CVSS 7.8 (high), 2023-10-27: VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges…
• CVE-2023-34058 - CVSS 7.5 (high), 2023-10-27: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges…
• CVE-2023-20900 - CVSS 7.5 (high), 2023-08-31: A malicious actor that has been granted Guest Operation Privileges…
• CVE-2023-20867 - CVSS 3.9 (low), 2023-06-13: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the…
• CVE-2022-31693 - CVSS 5.5 (medium), 2023-06-07: VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with…
• CVE-2022-31676 - CVSS 7.8 (high), 2022-08-23: VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the…
• CVE-2022-22977 - CVSS 7.1 (high), 2022-05-24: VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user…
• CVE-2022-22943 - CVSS 6.7 (medium), 2022-03-03: VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative…
• CVE-2021-21999 - CVSS 7.8 (high), 2021-06-23: VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4…
• CVE-2021-21997 - CVSS 5.5 (medium), 2021-06-18: VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user…
• CVE-2020-3972 - CVSS 3.3 (low), 2020-06-19: VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation.…
• CVE-2020-3941 - CVSS 7 (high), 2020-01-15: The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is…
• CVE-2019-5522 - CVSS 7.1 (high), 2019-06-06: VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This…
• CVE-2018-6969 - CVSS 7 (high), 2018-07-13: VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to…
• CVE-2015-5191 - CVSS 6.7 (medium), 2017-07-28: VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation…
• CVE-2016-5328 - CVSS 5.5 (medium), 2016-12-29: VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses…
• CVE-2016-7080 - CVSS 7.8 (high), 2016-12-29: The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL…
• CVE-2016-7079 - CVSS 7.8 (high), 2016-12-29: The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL…
• CVE-2016-5330 - CVSS 7.8 (high), 2016-08-08: Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro…
• CVE-2014-4199 - CVSS 6.3 (medium), 2014-08-28: vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via…
• CVE-2014-4200 - CVSS 4.7 (medium), 2014-08-28: vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive,…