A null pointer dereference in VMware Workstation for Windows can cause a software crash when an authenticated user triggers it, leading to a loss of service for the workstation. This flaw does not enable code execution or data exfiltration but results in a denial of service for the local host. The weakness is classified as CWE‑476.

VMware Workstation software running on Windows operating systems is affected. Specific version information is not provided in the advisory; any installations of VMware Workstation that have not applied the advertised patches are vulnerable.

The CVSS score of 6.1 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting exploitation is unlikely but still possible in environments where an attacker has local authenticated access. Because the flaw requires local authentication and is not listed in the CISA KEV catalog, the risk is moderate with low probability of exploitation.