CVE-2018-6974

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
VMware	ESXi	6.7 before ESXi670-201810101-SG; 6.5 before ESXi650-201808401-BG; 6.0 before ESXi600-201808401-BG
VMware	Workstation	14.x before 14.1.3
VMware	Fusion	10.x before 10.1.3

References

http://www.securityfocus.com/bid/105660Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041875Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041876Broken Link, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0026.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/105660Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041875Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041876Broken Link, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0026.htmlPatch, Vendor Advisory

Timeline

Published: Oct 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-69755.5The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are n CVE-2018-69765.3The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates CVE-2018-69776.5VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infi CVE-2018-69786.7vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege esca CVE-2018-69797.4The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.CVE-2018-69807.2VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user r CVE-2018-69818.8VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG,CVE-2018-69826.5VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in th CVE-2018-69838.8VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer ove CVE-2018-70327.5webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a Mi CVE-2018-70339.8SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD.CVE-2018-70347.5TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value,