Skip to content
Fencer Intel
high 7.8

CVE-2016-5330 in the critical feed json

Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware…

published 2016-08-08 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-6281

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.5%
EPSS 19.5% chance of exploitation in 30 days, percentile 97%
public exploits
2
Metasploit, Exploit-DB

Summary

Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

Patch / fix

  • vmware workstation_player 12.1.1
  • vmware workstation_pro 12.1.1
  • vmware fusion 8.1.1

Timeline

  1. First public exploit (Metasploit exploit/windows/misc/vmhgfs_webdav_dll_sideload)
  2. Published

Exploit prediction

19.49% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/misc/vmhgfs_webdav_dll_sideload DLL Side Loading Vulnerability in VMware Host Guest Client Redirector metasploit exploit, normal rank, 2016-08-05
  • EDB-41711 VMware Host Guest Client Redirector - DLL Side Loading (Metasploit) local, 2016-08-06
  • securify.nl https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.