CVE-2017-4903 VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without pat...

HighCVSS 8.8 EPSS 0.41%

Published: 2017-06-07 21:00
Updated: 2026-06-17 04:19
Exploit status: No public exploit known

Description

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have an uninitialized stack memory usage in SVGA. This issue may allow a guest to execute code on the host.

Affected products

Product	Affected versions	Fixed in
VMware workstation player	>= 12.0.0, < 12.5.5	12.5.5
VMware workstation pro	>= 12.0.0, < 12.5.5	12.5.5
VMware esxi	= 5.5	No fix listed
VMware esxi	= 5.5-1	No fix listed
VMware esxi	= 5.5-2	No fix listed
VMware esxi	= 5.5-3a	No fix listed
VMware esxi	= 5.5-3b	No fix listed
VMware esxi	= 6.0	No fix listed
VMware esxi	= 6.0-1	No fix listed
VMware esxi	= 6.0-1a	No fix listed
VMware esxi	= 6.0-1b	No fix listed
VMware esxi	= 6.0-2	No fix listed
VMware esxi	= 6.0-3	No fix listed
VMware esxi	= 6.0-3a	No fix listed
VMware esxi	= 6.0-600-201504401	No fix listed
VMware esxi	= 6.0-600-201505401	No fix listed
VMware esxi	= 6.0-600-201507101	No fix listed
VMware esxi	= 6.0-600-201507102	No fix listed
VMware esxi	= 6.0-600-201507401	No fix listed
VMware esxi	= 6.0-600-201507402	No fix listed
VMware esxi	= 6.0-600-201507403	No fix listed
VMware esxi	= 6.0-600-201507404	No fix listed
VMware esxi	= 6.0-600-201507405	No fix listed
VMware esxi	= 6.0-600-201507406	No fix listed
VMware esxi	= 6.0-600-201507407	No fix listed

Show 70 more

Product	Affected versions	Fixed in
VMware esxi	= 6.0-600-201509101	No fix listed
VMware esxi	= 6.0-600-201509102	No fix listed
VMware esxi	= 6.0-600-201509201	No fix listed
VMware esxi	= 6.0-600-201509202	No fix listed
VMware esxi	= 6.0-600-201509203	No fix listed
VMware esxi	= 6.0-600-201509204	No fix listed
VMware esxi	= 6.0-600-201509205	No fix listed
VMware esxi	= 6.0-600-201509206	No fix listed
VMware esxi	= 6.0-600-201509207	No fix listed
VMware esxi	= 6.0-600-201509208	No fix listed
VMware esxi	= 6.0-600-201509209	No fix listed
VMware esxi	= 6.0-600-201509210	No fix listed
VMware esxi	= 6.0-600-201510401	No fix listed
VMware esxi	= 6.0-600-201511401	No fix listed
VMware esxi	= 6.0-600-201601101	No fix listed
VMware esxi	= 6.0-600-201601102	No fix listed
VMware esxi	= 6.0-600-201601401	No fix listed
VMware esxi	= 6.0-600-201601402	No fix listed
VMware esxi	= 6.0-600-201601403	No fix listed
VMware esxi	= 6.0-600-201601404	No fix listed
VMware esxi	= 6.0-600-201601405	No fix listed
VMware esxi	= 6.0-600-201602401	No fix listed
VMware esxi	= 6.0-600-201603101	No fix listed
VMware esxi	= 6.0-600-201603102	No fix listed
VMware esxi	= 6.0-600-201603201	No fix listed
VMware esxi	= 6.0-600-201603202	No fix listed
VMware esxi	= 6.0-600-201603203	No fix listed
VMware esxi	= 6.0-600-201603204	No fix listed
VMware esxi	= 6.0-600-201603205	No fix listed
VMware esxi	= 6.0-600-201603206	No fix listed
VMware esxi	= 6.0-600-201603207	No fix listed
VMware esxi	= 6.0-600-201603208	No fix listed
VMware esxi	= 6.0-600-201605401	No fix listed
VMware esxi	= 6.0-600-201608101	No fix listed
VMware esxi	= 6.0-600-201608401	No fix listed
VMware esxi	= 6.0-600-201608402	No fix listed
VMware esxi	= 6.0-600-201608403	No fix listed
VMware esxi	= 6.0-600-201608404	No fix listed
VMware esxi	= 6.0-600-201608405	No fix listed
VMware esxi	= 6.0-600-201610410	No fix listed
VMware esxi	= 6.0-600-201611401	No fix listed
VMware esxi	= 6.0-600-201611402	No fix listed
VMware esxi	= 6.0-600-201611403	No fix listed
VMware esxi	= 6.0-600-201702101	No fix listed
VMware esxi	= 6.0-600-201702102	No fix listed
VMware esxi	= 6.0-600-201702201	No fix listed
VMware esxi	= 6.0-600-201702202	No fix listed
VMware esxi	= 6.0-600-201702203	No fix listed
VMware esxi	= 6.0-600-201702204	No fix listed
VMware esxi	= 6.0-600-201702205	No fix listed
VMware esxi	= 6.0-600-201702206	No fix listed
VMware esxi	= 6.0-600-201702207	No fix listed
VMware esxi	= 6.0-600-201702208	No fix listed
VMware esxi	= 6.0-600-201702209	No fix listed
VMware esxi	= 6.0-600-201702210	No fix listed
VMware esxi	= 6.0-600-201702211	No fix listed
VMware esxi	= 6.0-600-201702212	No fix listed
VMware esxi	= 6.5	No fix listed
VMware esxi	= 6.5-650-201701001	No fix listed
VMware esxi	= 6.5-650-201703001	No fix listed
VMware esxi	= 6.5-650-201703002	No fix listed
VMware Fusion	>= 8.0.0, < 8.5.6	8.5.6
VMware fusion pro	>= 8.0.0, < 8.5.6	8.5.6
VMware esxi	= 6.5 without patch ESXi650-201703410-SG	No fix listed
VMware esxi	= 6.0 U3 without patch ESXi600-201703401-SG	No fix listed
VMware esxi	= 6.0 U2 without patch ESXi600-201703403-SG	No fix listed
VMware esxi	= 6.0 U1 without patch ESXi600-201703402-SG	No fix listed
VMware esxi	= 5.5 without patch ESXi550-201703401-SG	No fix listed
VMware Workstation Pro / Player	= 12.x prior to 12.5.5	No fix listed
VMware Fusion Pro / Fusion	= 8.x prior to 8.5.6	No fix listed

References

97160 third-party-advisory vdb-entry
1038148 third-party-advisory vdb-entry
1038149 third-party-advisory vdb-entry
www.vmware.com patch vendor-advisory

CVSS v3.1

8.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.1 8.8 · nvd@nist.gov
v2.0 7.2 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.41% (percentile 35.8)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.