CVE-2022-22938

published 2022-01-28

CVE-2022-22938: VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado…

Priority P4 24 medium 6.5 CVSS 3.1

AV L AC L PR L UI N S C C N I N A H

VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
vmware	horizon	>= 5.0.0 < 5.5.3	5.5.3
vmware	workstation	>= 16.0.0 < 16.2.2	16.2.2

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.