VMware this week updated its Horizon 6, Horizon 7 and Horizon Client for Windows solutions to fix an important out-of-bounds read vulnerability in the Message Framework library.
"Successfully exploiting this issue may allow a less-privileged user to leak information from a privileged process running on a system where Horizon Connection Server, Horizon Agent or Horizon Client are installed," warns an 7 August security advisory from VMware.
VMware's Horizon Client software is designed to connect endpoint devices with virtual desktops and applications via the company's Horizon View desktop virtualisation product.
Designated CVE-2018-6970, the bug does not apply to Horizon products installed on Linux or other non-Windows systems. Horizon 6, 7 and Client for Windows are fixed with versions 6.2.7, 7.5.1 and 4.8.1, respectively.
The vulnerability's discovery has been credited to Steven Seeley of Source Incite, working in conjunction with Trend Micro's Zero Day Initiative.