CVE-2013-1406

VMware Workstation 8.x-9.x, Fusion 4.1-5.0, View 4.x-5.x, ESXi 4.0-5.1, ESX 4.0-4.1 Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-1406. PoCs published by Artem Shishkin.

AI-analyzed exploit summary This exploit targets CVE-2013-1406, a Windows kernel pool overflow vulnerability, by spraying semaphores to create a memory window and manipulate handle tables for privilege escalation. The code includes functions for handle lookup, object address resolution, and pool manipulation.

Description

The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.

Exploits (1)

exploitdb WORKING POC
by Artem Shishkin · clocalmultiple
https://www.exploit-db.com/exploits/40164

This exploit targets CVE-2013-1406, a Windows kernel pool overflow vulnerability, by spraying semaphores to create a memory window and manipulate handle tables for privilege escalation. The code includes functions for handle lookup, object address resolution, and pool manipulation.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (XP, 7)
No auth needed
Prerequisites: Access to a vulnerable Windows system · Ability to execute arbitrary code
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164

Scores

EPSS 0.0097
EPSS Percentile 57.1%

Details

CWE
CWE-20
Status published
Products (29)
vmware/esx 4.0
vmware/esx 4.1
vmware/esxi 4.0 (5 CPE variants)
vmware/esxi 4.1 (3 CPE variants)
vmware/esxi 5.0 (3 CPE variants)
vmware/esxi 5.1
vmware/fusion 4.1
vmware/fusion 4.1.1
vmware/fusion 4.1.2
vmware/fusion 4.1.3
... and 19 more
Published Feb 11, 2013
Tracked Since Feb 18, 2026