An out‑of‑bounds write bug in VMware Workstation versions 25H1 and earlier lets a user with non‑administrative rights in a guest virtual machine cause the termination of certain Workstation processes, effectively denying service to the host. The weakness is a classic buffer overrun insufficiency (CWE‑787).

VMware Workstation 25H1 and older on any supported operating system. Users of these versions are exposed to the flaw regardless of the host platform.

The vulnerability scores a moderate CVSS of 5.0 and has a very low likelihood of exploitation (EPSS < 1%). It is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widely used exploit at this time. An attacker would need to be able to run unprivileged code inside the guest VM, then exploit the buffer overrun to trigger a write that leads to process termination on the host. Because the attack vector is local to the guest, the risk is confined to hosts where the attacker already has some presence in a guest machine.