← Vulnerability feed

Vulnerability record · CVE-2020-3987 · published 16 September 2020

CVE-2020-3987: Vmware horizon client out-of-bounds read vulnerability

Vmware · Horizon Client

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.

6.1 CVSS 3.1 Medium EPSS 0.30% · top 76.9% CWE-125 · Out-of-bounds read
6.1CVSS 3.1 base score, v2 3.6
0.30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.vmware.com/security/advisories/VMSA-2020-0020.html Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2020-0020.html Vendor Advisory

Track CVE-2020-3987 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2020-3950VMware Fusion, VMRC and Horizon Client setuid privilege escalationVMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac mishandle setuid binaries, allowing a local user to gain root. The flaw affec…KEVEPSS 7.3%analysed8.8CVE-2017-4933Vmware workstation pro out-of-bounds write vulnerabilityVMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could all…EPSS 3.6%8.8CVE-2017-4924Vmware fusion out-of-bounds write vulnerabilityVMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds wr…EPSS 0.61%8.8CVE-2017-4903Vmware workstation player memory buffer overflow vulnerabilityVMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 with…EPSS 0.41%8.8CVE-2017-4898Vmware workstation player vulnerabilityVMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a…EPSS 0.39%8.8CVE-2017-4904Vmware fusion memory buffer overflow vulnerabilityThe XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-20…EPSS 0.43%8.8CVE-2017-4902Vmware workstation player memory buffer overflow vulnerabilityVMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fus…EPSS 0.52%8.8CVE-2016-7461Vmware fusion memory buffer overflow vulnerabilityThe drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion …EPSS 0.56%

Source: NIST National Vulnerability Database (record CVE-2020-3987), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.