CVE-2007-5671
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware...
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
Exploit likelihood
What each source reports
NVD Score used
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
- Record
CVE-2007-5671- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
- Record
CVE-2007-5671- Updated
- 2026-11-02
EUVDEUVD-2007-5643 No score
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
- Record
EUVD-2007-5643- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rcvp-7793-9q23 No score
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware...
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
- Record
GHSA-rcvp-7793-9q23- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5671 is a medium vulnerability (CVSS 4.4) in Vmware Ace, published June 5, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.
References
security.gentoo.org/glsa/glsa-201209-25.xml
vupen.com/english/advisories/2008/1744
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5688
vmware.com/security/advisories/VMSA-2008-0009.html
secunia.com/advisories/30556
labs.idefense.com/intelligence/vulnerabilities/display.php?id=712
Show 8 moreShow less
securityfocus.com/archive/1/493172/100/0/threaded
securitytracker.com/id?1020197
securityreason.com/securityalert/3922
nvd.nist.gov/vuln/detail/CVE-2007-5671
github.com/advisories/GHSA-rcvp-7793-9q23