CVE-2021-21988

    Dashboard / Vulnerabilities / CVE-2021-21988

    CVE-2021-21988

    Published: 24 May 2021Last Modified: 11 Feb 2026

    Summary:

    Details: VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (JPEG2000 Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.

    References: https://www.vmware.com/security/advisories/VMSA-2021-0009.html, https://www.zerodayinitiative.com/advisories/ZDI-21-609/, https://www.vmware.com/security/advisories/VMSA-2021-0009.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f73f97dac63b4875262b842582618e70e2f88e1e
    Fixed -d4ebf7d9990eb5b338d9e965effba8fbc3bff694

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-21988 | CVE-DB