Vmware Open-Vm-Tools vulnerabilities

17 known vulnerabilities affecting vmware/open-vm-tools.

Total CVEs

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

HIGH6MEDIUM8LOW3

Vulnerabilities

Page 1 of 1

CVE-2025-41244HIGHCVSS 7.8KEV≥ 0, < 2:11.2.5-2+deb11u5≥ 0, < 2:12.2.0-1+deb12u4+2 more2025-09-29

CVE-2025-41244 [HIGH] CVE-2025-41244: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

osv

CVE-2025-22247MEDIUMCVSS 6.1≥ 0, < 2:11.2.5-2+deb11u4≥ 0, < 2:12.2.0-1+deb12u3+1 more2025-05-12

CVE-2025-22247 [MEDIUM] CVE-2025-22247: VMware Tools contains an insecure file handling vulnerability VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

osv

CVE-2023-34059HIGHCVSS 7.4≥ 11.0.0, ≤ 12.3.02023-10-27

CVE-2023-34059 [HIGH] CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.

cvelistv5osv

CVE-2023-34058HIGHCVSS 7.1≥ 11.0.0, ≤ 12.3.02023-10-27

CVE-2023-34058 [HIGH] CVE-2023-34058: VMware Tools contains a SAML token signature bypass vulnerability VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https

cvelistv5osv

CVE-2023-20900HIGHCVSS 7.5≥ 0, < 2:11.2.5-2+deb11u2≥ 0, < 2:12.2.0-1+deb12u1+1 more2023-08-31

CVE-2023-20900 [HIGH] CVE-2023-20900: A malicious actor that has been granted Guest Operation Privileges https://docs A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public

osv

CVE-2023-20867LOWCVSS 3.9KEV≥ 0, < 2:10.2.0-3~ubuntu0.16.04.1+esm2≥ 0, < 2:11.0.5-4ubuntu0.18.04.3+esm1+2 more2023-07-27

CVE-2023-20867 [LOW] open-vm-tools vulnerability open-vm-tools vulnerability It was discovered that Open VM Tools incorrectly handled certain authentication requests. A fully compromised ESXi host can force Open VM Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

osv

CVE-2009-1143HIGHCVSS 7.0v2009.03.18-1548482022-11-23

CVE-2009-1143 [HIGH] CWE-59 CVE-2009-1143: An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access r An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that leverages a realpath race condition in mount.vmhgfs (aka hgfsmounter).

nvdosv

CVE-2009-1142MEDIUMCVSS 6.7≥ 0, < 2:8.4.2+2011.08.21-471295-12022-11-23

CVE-2009-1142 [MEDIUM] CVE-2009-1142: An issue was discovered in open-vm-tools 2009 An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.

osv

CVE-2022-31676HIGHCVSS 7.8≥ 0, < 2:11.2.5-2+deb11u1≥ 0, < 2:12.1.0-12022-08-23

CVE-2022-31676 [HIGH] CVE-2022-31676: VMware Tools (12 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.

osv

CVE-2015-5191MEDIUMCVSS 6.7≥ 0, < 2:10.1.5-5055683-52017-07-28

CVE-2015-5191 [MEDIUM] CVE-2015-5191: VMware Tools prior to 10 VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

osv

CVE-2014-4199MEDIUMCVSS 6.3≥ 0, < 2:9.4.6-1770165-72014-08-28

CVE-2014-4199 [MEDIUM] CVE-2014-4199: vm-support 0 vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

osv

CVE-2014-4200MEDIUMCVSS 4.7≥ 0, < 2:9.4.6-1770165-12014-08-28

CVE-2014-4200 [MEDIUM] CVE-2014-4200: vm-support 0 vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

osv

CVE-2013-3237MEDIUMCVSS 4.9≥ 0, < 2:9.2.2-893683-82013-04-22

CVE-2013-3237 [MEDIUM] CVE-2013-3237: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

osv

CVE-2011-2145MEDIUMCVSS 6.3≥ 0, < 2:8.4.2+2011.08.21-471295-12011-06-06

CVE-2011-2145 [MEDIUM] CVE-2011-2145: mount mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1, when a Solaris or FreeBSD guest OS is used, allows guest OS users to modify arbitrary guest OS files via unspecified vectors, related to a "procedural error."

osv

CVE-2011-1787MEDIUMCVSS 6.9≥ 0, < 2:8.4.2+2011.08.21-471295-12011-06-06

CVE-2011-1787 [MEDIUM] CVE-2011-1787: Race condition in mount Race condition in mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to gain privileges on the guest OS by mounting a filesystem on top of an arbitrary directory.

osv

CVE-2011-2146LOWCVSS 2.1≥ 0, < 2:8.4.2+2011.08.21-471295-12011-06-06

CVE-2011-2146 [LOW] CVE-2011-2146: mount mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to determine the existence of host OS files and directories via unspecified vectors.

osv

CVE-2011-1681LOWCVSS 3.3≤ 8.4.2-2610242011-04-10

CVE-2011-1681 [LOW] CVE-2011-1681: vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

nvdosv