Advisory Details

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the parsing of shader bytecode. By manipulating a document's elements, an attacker can trigger a read past the end of an allocated array. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor.

• 2018-08-30 - Vulnerability reported to vendor
• 2019-04-17 - Coordinated public release of advisory